Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

suppaftp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    FTP command injection via CRLF in control channel arguments

    GHSA-8mhj-xm4h-m5m6

    Affected
    • crates.io suppaftp >= 0.0.0-0, < 10.0.2
    Fixed in
    10.0.2· Vendor fix available
    Issue
    Affected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\r`) or a line feed (`\n`) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session. An application that passes untrusted input as credentials, paths or command strings to methods such as `login`, `cwd`, `mkdir`, `rmdir`, `rm`, `rename`, `retr`, `put_file`, `site` or `custom_command` can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected `PORT`. All three clients are affected: sync, tokio and smol, with or without TLS. The flaw was corrected in version 10.0.2 (commit 194bdd1): every command line is…

    Recommended action: Upgrade to 10.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →