An unauthenticated attacker can perform FTP command injection in the basic-ftp library, potentially leading to unauthorized data manipulation or service disruption.

This vulnerability involves improper neutralization of CRLF sequences, which allows an unauthenticated attacker to inject malicious commands into FTP API calls such as cd(), remove(), or uploadFrom(). By including newline characters in path parameters, the library splits intended commands, effectively bypassing security controls on the FTP control socket.

The ability to inject arbitrary FTP commands poses a significant risk to data integrity and system availability. An attacker could potentially delete files, upload unauthorized content, or manipulate directory structures, which may lead to severe operational disruption or loss of sensitive information. With a CVSS score of 8.6, this flaw is classified as High severity, necessitating immediate attention to prevent unauthorized system interaction.

Immediate Action: Update the basic-ftp dependency to version 5.2.1 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review application logs for unusual file path inputs containing newline characters or suspicious FTP command sequences that deviate from standard operational patterns.

Compensating Controls: While no direct WAF rule can replace a patch, ensure that all application inputs are strictly validated for illegal characters before being passed to library functions.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Given the High severity of this command injection vulnerability and the availability of a public proof-of-concept, organizations using the basic-ftp library must prioritize updating to version 5.2.1. Failure to address this flaw could allow attackers to gain unauthorized control over FTP operations, leading to critical data integrity issues. Ensure all development and production environments are patched to eliminate this attack vector.