CVE-2020-15152
Critical
Description
ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.
SeverityCritical
CVSS9.1
Exploit probability—
ProductFtp-srv
PublishedAug 17, 2020
First seenAug 17, 2020
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- ftp-srv_project ftp-srv2.19.6, 3.1.2, 4.3.4 or later
- ftp-srv2.19.6, 3.1.2, 4.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ftp-srv_project ftp-srv | v < 2.19.6, 3.0.0 ≤ v < 3.1.2, 4.0.0 ≤ v < 4.3.4 | 2.19.6, 3.1.2, 4.3.4 |
| ftp-srvnpm | 1.0.0 ≤ v < 2.19.6, 3.0.0 ≤ v < 3.1.2, 4.0.0 ≤ v < 4.3.4 | 2.19.6, 3.1.2, 4.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.