Basic Ftp
Monthly
Quadratic CPU consumption in basic-ftp before 6.2.1 lets a malicious or compromised FTP server freeze a Node.js application that calls Client.list(): the RE_LINE pattern in src/parseListUnix.ts backtracks across the optional, unbounded owner and group fields of a crafted Unix-style directory line, and because parseList() picks a parser from the last nonblank line and then applies it to every line, a normal trailing entry can force the vulnerable Unix parser onto the earlier hostile line and block the event loop. The attack requires the victim to connect out to an untrusted or attacker-controlled FTP endpoint and perform a listing (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability only, no confidentiality or integrity impact); unauthenticated attackers are sufficient, but the trust direction is the limiting factor, so systems that only talk to trusted FTP servers are not realistically exposed. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV), and the vendor-released patch is version 6.2.1.
Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications via unbounded memory consumption during directory listing operations. Attackers controlling or compromising an FTP server can send infinite or extremely large listing responses to Client.list() calls, exhausting client memory until process termination. Unauthenticated network attack with low complexity (CVSS:3.1 AV:N/AC:L/PR:N). No public exploit identified at time of analysis, though attack concept is straightforward for anyone operating a malicious FTP server.
Path traversal in basic-ftp Node.js FTP client library before 5.2.0 allows malicious FTP servers to write files outside the intended download directory. PoC and patch available.
Quadratic CPU consumption in basic-ftp before 6.2.1 lets a malicious or compromised FTP server freeze a Node.js application that calls Client.list(): the RE_LINE pattern in src/parseListUnix.ts backtracks across the optional, unbounded owner and group fields of a crafted Unix-style directory line, and because parseList() picks a parser from the last nonblank line and then applies it to every line, a normal trailing entry can force the vulnerable Unix parser onto the earlier hostile line and block the event loop. The attack requires the victim to connect out to an untrusted or attacker-controlled FTP endpoint and perform a listing (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability only, no confidentiality or integrity impact); unauthenticated attackers are sufficient, but the trust direction is the limiting factor, so systems that only talk to trusted FTP servers are not realistically exposed. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV), and the vendor-released patch is version 6.2.1.
Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications via unbounded memory consumption during directory listing operations. Attackers controlling or compromising an FTP server can send infinite or extremely large listing responses to Client.list() calls, exhausting client memory until process termination. Unauthenticated network attack with low complexity (CVSS:3.1 AV:N/AC:L/PR:N). No public exploit identified at time of analysis, though attack concept is straightforward for anyone operating a malicious FTP server.
Path traversal in basic-ftp Node.js FTP client library before 5.2.0 allows malicious FTP servers to write files outside the intended download directory. PoC and patch available.