In VSFTPD, the default for pasv_promiscuous is "NO", and the man page indicates:
Only enable if you know what you are doing! The only legitimate use for this is in some form of secure tunnelling scheme, or perhaps to facilitate FXP support.
Although we have never had a problem with this, we now have a customer who apparently needs to have this set to "YES" so they can connect through their proxy. I see numerous recommendations on the web to setting it to YES to fix the problem that we're having, but I can't find any details about what the real risk of this setting is.
I've been trying to figure out what this is guarding against, and the best I can come up with is that it's protecting against someone trying to hijack the connection after signon and before opening the data connection. It seems (although I'm not sure) that an attacker would have to know the ports used for the passive connection and repeatedly attempt to access those ports in hope for catching one open at the right moment, but maybe it's easier than that? Assuming such an attack is successful, what does that give the attacker? I presume simply whatever access the hijacked user session had.
Does anybody have a good explanation of what is the realistic security risk of pasv_promiscuous=YES?