Description
The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Rapid7 | Metasploit Framework | < 6.5.7 | 6.5.7 |
References
- https://github.com/rapid7/metasploit-framework/pull/21994 patch release-notes