PT-2021-11238 · Ftpsrv · Ftp-Srv

N-Timofeev · Published 2021-02-10 · Updated 2021-02-19 · CVE-2020-26299

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ftp-srv versions prior to 4.4.0

Description: The issue concerns a path-traversal vulnerability in ftp-srv, an open-source FTP server. Clients of FTP servers utilizing ftp-srv hosted on Windows machines can escape the FTP user's defined root folder using expected FTP commands, such as CWD and UPDR. This occurs when Windows separators exist within the path (``), and path.resolve leaves the upper pointers intact, allowing the user to move beyond the root folder defined for that user.

Recommendations: For versions prior to 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider hosting the server on a different OS to mitigate the issue, as there are no workarounds for Windows servers.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-26299

GHSA-PMW4-JGXX-PCQ9

Affected Products

Ftp-Srv

References · 10

• 🔥 https://github.com/autovance/ftp-srv/security/advisories/GHSA-pmw4-jgxx-pcq9 · Exploit
• 🔥 https://github.com/autovance/ftp-srv/issues/225 · Exploit
• 🔥 https://github.com/autovance/ftp-srv/issues/167 · Exploit
• https://github.com/autovance/ftp-srv/commit/457b859450a37cba10ff3c431eb4aa67771122e3 · Patch
• https://github.com/autovance/ftp-srv/pull/224 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26299 · Security Note
• https://osv.dev/vulnerability/GHSA-pmw4-jgxx-pcq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26299 · Vendor Advisory
• https://t.me/cibsecurity/23364 · Telegram Post
• https://npmjs.com/package/ftp-srv · Note