From 4f85853f641863d5915786a8413e1a213726a62b Mon Sep 17 00:00:00 2001
From: Acts1631 <acts1631kjv@proton.me>
Date: Sun, 5 Jul 2026 17:22:55 -0400
Subject: [PATCH] ftp: validate PASV/LPSV response address against control
 connection peer

* src/ftp-basic.c (ftp_pasv): Reject if peer address doesn't match advertised
  address,
  (ftp_lpsv): Likewise.

ftp_pasv() and ftp_lpsv() copied the IP address and port advertised in
the server's 227 response without checking that it matched the peer
of the control connection.  A malicious or compromised FTP server
could therefore direct wget's data connection to an arbitrary host and
port of its choosing (e.g. an internal service unreachable from the
attacker directly), which is a server-side request forgery.

ftp_epsv() was already safe since it only extracts a port and reuses
the pre-filled control-connection address.

Fix ftp_pasv() and ftp_lpsv() the same way: capture the control
connection's peer address via socket_ip_address() before parsing the
response, and reject the response (FTPINVPASV) if the parsed address
does not match.

Verified with a fake FTP server that returns a PASV response pointing
at a different loopback address (127.0.0.2 instead of the real peer
127.0.0.1): before the fix wget connects to the spoofed address, after
the fix it rejects the response with "Cannot parse PASV response."
Legitimate transfers using a correctly-addressed PASV response
continue to work.

Copyright-paperwork-exempt: Yes

Upstream commit (GitLab mirror):
https://gitlab.com/gnuwget/wget/-/commit/4f85853f641863d5915786a8413e1a213726a62b

--- wget-1.25.0/src/ftp-basic.c
+++ wget-1.25.0/src/ftp-basic.c
@@ -623,10 +623,19 @@ char *request, *respline, *s;
   int nwritten, i;
   uerr_t err;
   unsigned char tmp[6];
+  ip_address peer_addr;
 
   assert (addr != NULL);
   assert (port != NULL);
 
+  /* Remember who we are talking to on the control connection, so that
+     the address returned in the PASV response can be checked below.
+     Accepting an arbitrary server-supplied address would let a
+     malicious FTP server redirect our data connection to any host of
+     its choosing (SSRF).  */
+  if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
+    return FTPINVPASV;
+
   xzero (*addr);
 
   /* Form the request.  */
@@ -677,6 +686,16 @@ addr->family = AF_INET;
   memcpy (IP_INADDR_DATA (addr), tmp, 4);
   *port = ((tmp[4] << 8) & 0xff00) + tmp[5];
 
+  /* Reject the response if the advertised address does not match the
+     control connection's peer.  */
+  if (peer_addr.family != AF_INET
+      || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr), 4) != 0)
+    {
+      xzero (*addr);
+      *port = 0;
+      return FTPINVPASV;
+    }
+
   return FTPOK;
 }
 
@@ -692,10 +711,19 @@ int nwritten, i, af, addrlen, portlen;
   uerr_t err;
   unsigned char tmp[16];
   unsigned char tmpprt[2];
+  ip_address peer_addr;
 
   assert (addr != NULL);
   assert (port != NULL);
 
+  /* Remember who we are talking to on the control connection, so that
+     the address returned in the LPSV response can be checked below.
+     Accepting an arbitrary server-supplied address would let a
+     malicious FTP server redirect our data connection to any host of
+     its choosing (SSRF).  */
+  if (!socket_ip_address (csock, &peer_addr, ENDPOINT_PEER))
+    return FTPINVPASV;
+
   xzero (*addr);
 
   /* Form the request.  */
@@ -842,6 +870,18 @@ DEBUGP (("tmpprt[1] is: %d\n", tmpprt[1]
       DEBUGP (("*port is: %d\n", *port));
     }
 
+  /* Reject the response if the advertised address does not match the
+     control connection's peer.  */
+  if (peer_addr.family != addr->family
+      || memcmp (IP_INADDR_DATA (addr), IP_INADDR_DATA (&peer_addr),
+                 af == 4 ? 4 : 16) != 0)
+    {
+      xzero (*addr);
+      *port = 0;
+      xfree (respline);
+      return FTPINVPASV;
+    }
+
   xfree (respline);
   return FTPOK;
 }