REDHAT-BUG-2456971: Command Injection
basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences (\r\n) in file path parameters passed to high-level path APIs such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir(). The library's protectWhitespace() helper only handles leading spaces and returns other paths unchanged, while FtpContext.send() writes the resulting command string directly to the control socket with \r\n appended. This lets attacker-controlled path strings split one intended FTP command into multiple commands. This vulnerability is fixed in 5.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
basic-ftpto a version that resolves this vulnerability.Fixed in 5.2.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using basic-ftp versions prior to 5.2.1 are exposed when they pass attacker-controlled file path values to high-level APIs including cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), or removeDir().
What does an attacker need to exploit it?
An attacker needs to influence a path parameter supplied to an affected high-level basic-ftp API. The supplied value must contain CRLF sequences so it can terminate the intended FTP command and inject additional commands on the FTP control connection.
Is there a fix available?
Yes. The issue is fixed in basic-ftp version 5.2.1.