The vulnerability exists in the ftp_internal:handle_ctrl_result/2 PASV handler of Erlang/OTP's ftp module, where the IP address extracted from the server's 227 PASV response is used directly in gen_tcp:connect/4 without validation against the control connection's peer address. Unlike the EPSV handlers, the PASV handler does not verify the IP, enabling a malicious FTP server to redirect data connections to arbitrary hosts and ports. This can be exploited to perform SSRF attacks against internal hosts, cloud metadata endpoints, or third-party hosts via FTP bounce attacks. The affected code spans inets versions 5.10.4 through before 7.0 and ftp versions 1.0 through before 1.2.6, 1.2.4.1, and 1.2.3.1, corresponding to OTP versions from 17.4 before 29.0.2, including 28.5.0.2 and 27.3.4.13. The ftp application is deprecated and planned for removal in OTP-30.

An attacker controlling or compromising an FTP server can exploit this vulnerability to redirect the client's data connection to arbitrary internal or external hosts and ports. This enables SSRF attacks, potentially exposing internal network resources or cloud metadata endpoints. Additionally, FTP bounce attacks against third-party hosts are possible. The vulnerability affects read and write FTP operations, allowing data exfiltration or injection via the redirected connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The ftp application is deprecated and scheduled for removal in OTP-30, which may mitigate future risk. Until an official fix is available, avoid using the vulnerable ftp module in passive mode with inet IP family and ftp_extension set to false, or restrict FTP server connections to trusted hosts. Monitor vendor advisories for updates and patches.