Ruby: lib/net/ftp.rb: trusting PASV responses allow client abuse

🗓️ 02 Apr 2021 15:56:47Reported by sighookType

hackerone

hackerone🔗 hackerone.com👁 68 Views

net/ftp PASV response abuse can lead to potential SSRF and security risk

Reporter	Title	Published	Views	Family All 513
ibm	Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2020-8284, CVE-2020-8285, and CVE-2020-8286)	15 Mar 202117:09	–	ibm
ibm	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
ibm	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202116:40	–	ibm
ibm	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202101:09	–	ibm
ibm	Security Bulletin: IBM MQ is affected by a vulnerability within libcurl (CVE-2020-8284)	19 May 202111:57	–	ibm
ibm	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
ibm	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (Multiple CVEs)	22 Apr 202212:50	–	ibm
nessus	Mozilla Firefox < 1.5.0.11 / 2.0.0.3 Multiple Vulnerabilities	22 Mar 200700:00	–	nessus
nessus	Amazon Linux 2 : curl (ALAS-2021-1693)	6 Aug 202100:00	–	nessus
nessus	Amazon Linux 2 : ruby (ALAS-2024-2534)	30 Apr 202400:00	–	nessus

08 Jul 2021 15:34Current

6.9Medium risk

Vulners AI Score6.9

EPSS0.13847

$500

ftp protocol design security risks passive mode.