GitHub Advisoryadvisory · npm

GHSA-pmw4-jgxx-pcq9 File System Bounds Escape

MEDIUM Published 2021-02-10 Modified 2021-02-11 Official page ↗
Aliases
CVE-2020-26299
Ecosystem
npm
Packages
ftp-srv
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2021-02-10

Affected packages

• npm ftp-srv: < 4.4.0 → fixed in 4.4.0

Description

Impact Clients of FTP servers utilizing `ftp-srv` hosted on Windows machines can escape the FTP user's defined root folder using the expected FTP commands, for example, `CWD` and `UPDR`. Background When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function. Patches None at the moment. Workarounds There are no workarounds for windows servers. Hosting the server on a different OS mitigates the issue. References Issues: https://github.com/autovance/ftp-srv/issues/167 https://github.com/autovance/ftp-srv/issues/225 For more information If you have any questions or comments about this advisory: Open an issue at https://github.com/autovance/ftp-srv. Please email us directly; [email protected].

Related

Alias · CVE (1)

  • CVE-2020-26299 ftp-srv is an open-source FTP server designed to be simple yet configurable. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References