PSF-2021-5 ftplib should not use the host from the PASV response
A malicious FTP server can force the client to probe internal network addresses via PASV response, enabling SSRF-like attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is PSF-2021-5?
PSF-2021-5 is a server-side request forgery vulnerability, published on 21 Feb 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The IPv4 address value returned from the server in response to the PASV command should not be trusted. This prevents a malicious FTP server from using the response to probe IPv4 address and port combinations on the client network.
Instead of using the returned address, we use the IP address we're already connected to. This is the strategy other ftp clients adopted, and matches the only strategy available for the modern IPv6 EPSV command where the server response must return a port number and nothing else.
Which versions are affected by PSF-2021-5?
How do I fix PSF-2021-5?
No fix has been published for PSF-2021-5 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is PSF-2021-5 being exploited?
There is no known exploitation of PSF-2021-5 in the wild and no public exploit code.