Python ftplib PASV Response Vulnerability in ftpcp() Function Allows Server-Side Request Forgery

A vulnerability in the ftplib module of Python's standard library allows for server-side request forgery (SSRF) by trusting server-supplied PASV host addresses. The issue arises in the ftpcp() function, which still uses raw, attacker-controllable IP addresses and ports from the PASV response, instead of the actual peer address. This flaw could be exploited by a malicious FTP server to redirect connections to arbitrary IP addresses and ports, potentially leading to port scanning and banner grabbing from private networks.

Impact

Exploitation of this vulnerability could allow a malicious FTP server to redirect connections to internal IP addresses and ports, potentially leading to unauthorized access or information disclosure from private network services.

Remediation

Users can upgrade to Python versions 3.10.13, 3.11.6, 3.12.1, 3.13.0, 3.14.0, or 3.15.0, where this vulnerability has been fixed.