CVE-2020-15152: 
JavaScript vulnerability analysis and mitigation

ftp-srv is an npm package providing a modern and extensible FTP server designed to be simple yet configurable. In versions before 2.19.6, 3.1.2, and 4.3.4, the package was vulnerable to Server-Side Request Forgery (SSRF). The vulnerability was discovered and disclosed on August 17, 2020, affecting all versions from 1.0.0 through 4.3.3 (GitHub Advisory, NVD).

The vulnerability stems from the FTP protocol's PORT command implementation. The PORT command, which is used for creating data connections, allowed arbitrary IP addresses to be specified. This could be exploited to cause the server to establish connections to unintended destinations. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

If exploited, this vulnerability could allow an attacker to make the FTP server establish connections to arbitrary IP addresses. This could potentially be used for internal network scanning, data exfiltration, or as part of a larger attack chain. The high CVSS score reflects the critical nature of this security issue, particularly due to its potential for unauthorized access and information disclosure (GitHub Advisory).

The vulnerability is relatively straightforward to exploit as it requires no authentication (PR:N) and no user interaction (UI:N). An attacker only needs to send a specially crafted PORT command to the FTP server to trigger the vulnerable behavior (GitHub Advisory).

The issue has been fixed in versions 2.19.6, 3.1.2, and 4.3.4. Users are strongly advised to upgrade to these or later versions. As a temporary workaround, users can block the PORT command through the configuration by adding it to the blacklist: const ftp = new FtpSrv({ blacklist: ['PORT'] }) (GitHub Advisory).