CVE-2020-15152 Server-Side Request Forgery in ftp-srv
An attacker can exploit the PORT command in the ftp-srv library to force the server to make arbitrary connections, enabling Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15152?
CVE-2020-15152 is a critical server-side request forgery vulnerability in autovance ftp-srv, published on 17 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.
Weakness: CWE-918
Which versions are affected by CVE-2020-15152?
6 open source packages ship an affected version, including ftp-srv. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ftp-srv npm | From 1.0.0 | 2.19.6 |
ftp-srv npm | From 1.0.0 | 2.19.6 |
ftp-srv npm | From 3.0.0 | 3.1.2 |
ftp-srv npm | From 3.0.0 | 3.1.2 |
ftp-srv npm | From 4.0.0 | 4.3.4 |
ftp-srv npm | From 4.0.0 | 4.3.4 |
Products include Ftp-Srv Project Ftp-Srv.
How do I fix CVE-2020-15152?
Upgrade ftp-srv to a fixed version for your release line: 2.19.6, 3.1.2 or 4.3.4.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-15152 being exploited?
There is no known exploitation of CVE-2020-15152 in the wild and no public exploit code.
Other vulnerabilities in autovance ftp-srv
Sources
Also known as GHSA-jw37-5gqr-cf9j.