ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2...
概要
Server-Side Request Forgery in ftp-srv
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory nvd.nist.gov
- advisory npmjs.com
- patch github.com
- patch github.com
- web github.com
- web github.com
- web npmjs.com