Basic-Ftp - CraftedSignal Threat Feed

basic-ftp FTP Command Injection via CRLF Characters

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

The basic-ftp npm package, version 5.2.0, contains a command injection vulnerability stemming from improper sanitization of file path parameters. Specifically, the protectWhitespace() function fails to neutralize CRLF sequences (\r\n), allowing attackers to inject arbitrary FTP commands. The vulnerability exists because the send() function in FtpContext.js directly writes commands to the control socket with \r\n appended. This allows an attacker to craft malicious path strings that, when processed by the affected methods (cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), and removeDir()), result in the execution of unintended FTP commands. This vulnerability impacts applications that use basic-ftp to interact with FTP servers and accept user-controlled input for file paths. The vulnerability was confirmed in version 5.2.0, and as of 2026-04-04, no fix is available.

Attack Chain

An attacker crafts a malicious file path containing CRLF sequences (\r\n) and an injected FTP command.
The attacker provides the malicious path as input to one of the vulnerable basic-ftp methods, such as cd(), remove(), rename(), uploadFrom(), downloadTo(), list(), or removeDir().
The protectWhitespace() function in Client.js is called, but it fails to sanitize the CRLF sequences in the path.
The unsanitized path is passed to the send() function in FtpContext.js, which appends \r\n to the command string and writes it to the TCP socket.
The FTP server interprets the CRLF sequences as command delimiters, splitting the intended command into multiple commands.
The injected FTP command is executed by the server. This can include deleting files (DELE), creating/removing directories (MKD, RMD), or triggering downloads (RETR).
The attacker potentially hijacks the session by injecting USER and PASS commands.
The attacker gains unauthorized access to files, directories, or potentially executes arbitrary commands on the FTP server, leading to data exfiltration or service disruption.

Impact

Successful exploitation of this vulnerability can lead to severe consequences, including arbitrary file deletion, directory manipulation, file exfiltration, server command execution (if supported by the FTP server), session hijacking, and service disruption. The vulnerability poses a significant risk to applications that rely on basic-ftp and accept user-supplied file paths. If an attacker controls the FTP paths, they can inject arbitrary commands, compromising the confidentiality, integrity, and availability of the FTP server and its data.

Recommendation

Apply the immediate workaround by sanitizing all path inputs before passing them to basic-ftp, rejecting paths containing \r or \n characters. See the provided sanitization example in the mitigation section of this brief.
Monitor network connections for FTP traffic containing suspicious commands within file paths, using the provided Sigma rule targeting network connections with CRLF sequences.
Upgrade to a patched version of basic-ftp as soon as one becomes available that properly sanitizes or rejects CRLF sequences in file paths, addressing the root cause detailed in the overview of this brief.

basic-ftp Denial-of-Service Vulnerability via Unbounded Memory Consumption

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The basic-ftp npm package, specifically version 5.2.2 and earlier, is susceptible to a denial-of-service (DoS) vulnerability. This vulnerability arises when the package is used to list directories from a remote FTP server. A malicious or compromised FTP server can exploit this by sending an excessively large or unending directory listing in response to the Client.list() command. The basic-ftp client, upon receiving this malicious response, attempts to buffer the entire listing in memory using the StringWriter class. The StringWriter class lacks any size limitations, resulting in unbounded memory growth as it concatenates incoming data chunks. This sustained memory allocation eventually leads to process instability and, ultimately, a crash of the application or service utilizing the vulnerable basic-ftp package. The vulnerability stems from the package's default directory listing flow within dist/Client.js, where the full listing response is downloaded into a StringWriter before parsing, as well as the unlimited buffering capability of dist/StringWriter.js.

Attack Chain

An application using basic-ftp connects to an attacker-controlled or compromised FTP server.
The application initiates a directory listing request by calling the client.list() function.
The malicious FTP server responds with an extremely large or never-ending directory listing.
Within the basic-ftp library, the _requestListWithCommand function in dist/Client.js is invoked.
The downloadTo function in transfer_1.js starts downloading the listing response to a StringWriter instance.
The StringWriter class, in dist/StringWriter.js, receives chunks of data from the listing response.
The _write method of StringWriter concatenates each chunk to an in-memory Buffer without any size checks, leading to unbounded memory consumption via this.buf = Buffer.concat([this.buf, chunk]).
The excessive memory allocation causes the application's process to become unstable and eventually crash due to memory exhaustion.

Impact

This vulnerability allows a malicious actor to perform a denial-of-service attack against applications and services that rely on the basic-ftp package to interact with FTP servers. The attack is triggered when the application connects to a malicious FTP server and attempts to list a directory. Successful exploitation leads to excessive memory consumption, resulting in process instability and potential termination of the application. This can disrupt services, cause data unavailability, and negatively impact overall system reliability. The impact is primarily targeted at services using the vulnerable basic-ftp@5.2.2 against untrusted FTP endpoints.

Recommendation

Implement application-level checks to monitor memory usage and restart processes exceeding acceptable thresholds (reference: Impact section).
Deploy the Sigma rule Detect basic-ftp StringWriter Memory Exhaustion to identify processes using basic-ftp that are allocating large amounts of memory (reference: rules section).
Upgrade to a patched version of basic-ftp that includes a fix for the unbounded memory consumption issue.
Implement a maximum listing size within your application, aborting transfers that exceed the configured limit, as suggested in the advisory's remediation section.

basic-ftp CRLF Injection Vulnerability Allows Arbitrary FTP Command Execution

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

The basic-ftp npm package, versions 5.2.1 and earlier, contains an incomplete CRLF injection protection mechanism. This vulnerability allows attackers to inject arbitrary FTP commands into the control connection by bypassing the existing protectWhitespace() control. There are two primary attack vectors: the first involves injecting commands via the login() method by manipulating user-supplied credentials, and the second exploits a TOCTOU (Time-of-Check Time-of-Use) race condition in the _openDir() method. The vulnerability stems from the direct concatenation of user inputs into FTP commands without proper validation for CRLF characters (\r\n). Successful exploitation can lead to unauthorized file deletion, modification, and execution of arbitrary server commands. Applications that rely on basic-ftp and accept user-provided FTP credentials or paths are at high risk.

Attack Chain

Attacker identifies a target application using basic-ftp (<= 5.2.1) that accepts user-controlled FTP credentials or paths.
Attacker crafts a malicious username or password containing CRLF sequences followed by FTP commands, such as anonymous\r\nDELE important.txt.
The target application passes the crafted credentials to the login() method in basic-ftp.
The login() method concatenates the malicious username and password into USER and PASS commands without validation.
basic-ftp sends the crafted FTP commands to the FTP server. The injected command (e.g., DELE important.txt) executes before the PASS command.
Alternatively, the attacker crafts a malicious directory path containing CRLF sequences followed by FTP commands, such as test\r\nDELE important.txt/subdir.
The target application passes the crafted path to the ensureDir() method, which calls _openDir().
The _openDir() method sends an MKD command with the crafted path without validation. The injected command (e.g., DELE important.txt) executes.

Impact

Successful exploitation of this CRLF injection vulnerability can lead to several severe consequences. Attackers can delete or manipulate files on the FTP server by injecting DELE, RNFR, and RNTO commands. They can also create or remove directories using MKD and RMD. Furthermore, attackers can execute arbitrary server commands by injecting SITE commands, potentially changing file permissions (e.g., SITE CHMOD). In the case of credential injection, the attacker might be able to perform actions with default server permissions before proper authentication occurs. Applications that handle user-supplied FTP credentials, like web-based file managers, are prime targets.

Recommendation

Apply the recommended fix from the advisory by upgrading basic-ftp to a version greater than 5.2.1 or implementing CRLF validation as described in the advisory to prevent command injection in the login() and _openDir() methods.
Deploy the provided Sigma rule "Detect basic-ftp CRLF Injection in FTP Commands" to monitor for FTP commands containing CRLF characters in network traffic.
Enable network connection logging to capture FTP traffic for analysis and detection, as required by the Sigma rule.