GHSA-8mhj-xm4h-m5m6

Affected versions of suppaftp wrote command arguments (user name, password, paths, SITE arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (\r) or a line feed (\n) terminated the intended command line and let a second, attacker-chosen command be sent to the server within the same authenticated session.

An application that passes untrusted input as credentials, paths or command strings to methods such as login, cwd, mkdir, rmdir, rm, rename, retr, put_file, site or custom_command can therefore be made to execute arbitrary FTP commands with the application's privileges, for example deleting files or redirecting a data connection with an injected PORT.

All three clients are affected: sync, tokio and smol, with or without TLS.

The flaw was corrected in version 10.0.2 (commit 194bdd1): every command line is validated before it is written to the wire and rejected with FtpError::ConnectionError (std::io::ErrorKind::InvalidInput) if it contains CR or LF anywhere but in the trailing terminator. As a consequence, custom_command no longer accepts several commands joined by CRLF in a single call.

Users who cannot upgrade should reject or strip \r and \n from any untrusted string before passing it to the client.