Server-Side Request Forgery in ftp-srv

The ftp-srv module's vulnerability stems from improper handling of the PORT command in the FTP protocol. The PORT command, typically used by the client to specify the IP address and port for the server to connect back to, allows an attacker to inject a malicious IP address. This can be exploited to force the FTP server to establish a connection to a server controlled by the attacker, potentially leading to remote code execution. Successful exploitation could allow an attacker to gain complete control of the affected server, exfiltrate sensitive data, or launch further attacks against other systems on the network. This vulnerability shares similarities with other FTP-related vulnerabilities where improper input validation leads to arbitrary connection establishment.

Applications built on Node.js that utilize the ftp-srv module for FTP functionality are at risk. This includes custom-built applications, as well as those relying on older or unmaintained Node.js packages. Shared hosting environments where users have the ability to install or modify Node.js modules are particularly vulnerable.

• nodejs / server:

  ps aux | grep ftp-srv
  netstat -tulnp | grep :21 # Check for FTP connections

• linux / server:

  journalctl -u nodejs -f | grep PORT
  auditctl -l # Check for audit rules related to FTP connections

• generic web:

  curl -I http://your-ftp-server/ | grep Server # Check for ftp-srv version

1. 2020-08-17Disclosure

   disclosure

2. 2020-08-17Patch

   patch

1. Reserviert2020-06-25
2. Veröffentlicht2020-08-17
3. Geändert2026-03-13
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2020-15152 is to upgrade the ftp-srv module to version 2.19.6 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting outbound connections from the FTP server using a firewall or intrusion prevention system. Additionally, carefully review and restrict the permissions granted to the FTP user account to minimize the potential impact of a successful exploit. Monitor FTP server logs for suspicious connection attempts or unusual activity. After upgrading, confirm the fix by attempting a PORT command with a non-routable IP address; the server should reject the connection.