cve/2020/CVE-2020-15152.md

### [CVE-2020-15152](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15152)
![](https://img.shields.io/static/v1?label=Product&message=ftp-srv&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=%7B%22CWE-918%22%3A%22Server-Side%20Request%20Forgery%20(SSRF)%22%7D&color=brighgreen)

### Description

ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.19.6, 3.1.2, and 4.3.4 are vulnerable to Server-Side Request Forgery. The PORT command allows arbitrary IPs which can be used to cause the server to make a connection elsewhere. A possible workaround is blocking the PORT through the configuration. This issue is fixed in version2 2.19.6, 3.1.2, and 4.3.4. More information can be found on the linked advisory.

### POC

#### Reference
- https://www.npmjs.com/package/ftp-srv
- https://www.npmjs.com/package/ftp-srv

#### Github
- https://github.com/ossf-cve-benchmark/CVE-2020-15152