bugtraq - Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime Edition (Build 8)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <57AC6156.1090907@rv3lab.org>
Date: Thu, 11 Aug 2016 13:28:22 +0200
From: "Rv3Lab.org" <research@...lab.org>
To: submit@...sec.com, submissions@...ketstormsecurity.com,
  fulldisclosure@...lists.org, pen-test@...urityfocus.com,
  bugs@...uritytracker.com, bugtraq@...urityfocus.com, submit@...7day.com,
  submit@...ecurity.com, full-disclosure@...ts.grok.org.uk
Subject: Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime Edition
 (Build 8)

###################################################

01. ### Advisory Information ###

Title: Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime 
Edition (Build 8)
Date published: n/a
Date of last update: n/a
Vendors contacted: ColoradoFTP author Sergei Abramov
Discovered by: Rv3Laboratory [Research Team]
Severity: High

02. ### Vulnerability Information ###

OVE-ID: OVE-20160718-0006
CVSS v2 Base Score: 8.5
CVSS v2 Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Component/s: ColoradoFTP Core v1.3
Class: Path Traversal

03. ### Introduction ###

ColoradoFTP is the open source Java FTP server. It is fast, reliable and 
extendable.
Fully compatible with RFC 959 and RFC 3659 (File Transfer Protocol and 
Extensions)
this implementation makes it easy to extend the functionality with 
virtually any feature.
Well commented source code and existing plug-ins make it possible to 
shape the
FTP server just the way you want!

http://cftp.coldcore.com/

04. ### Vulnerability Description ###

The default installation and configuration of Colorado FTP Prime Edition 
(Build 8) is prone to a
security vulnerability. Colorado FTP contains a flaw that may allow a 
remote attacker to traverse directories on the FTP server.
A remote attacker (a colorado FTP user) can send a command (MKDIR, PUT, 
GET or DEL) followed by sequences (\\\..\\) to traverse directories
and create, upload, download or delete the contents of arbitrary files 
and directories on the FTP server.
To exploit the vulnerability It is important to use "\\\" at the 
beginning of string.

05. ### Technical Description / Proof of Concept Code ###

By supplying "\\\..\\..\\..\\..\\" in the file path, it is possible to 
trigger a directory traversal flaw, allowing the attacker
(anonymous user or Colorado FTP user) to upload or download a file 
outside the virtual directory.

05.01
We tried to upload a file (netcat - nc.exe), to Windows %systemroot% 
directory (C:\WINDOWS\system32\) using a PUT command:

ftp> put nc.exe \\\..\\..\\..\\Windows\\system32\\nc.exe

Netcat was successfully uploaded.

05.02
We tried to create a directory (test), using a MKDIR command:

ftp> mkdir nc.exe \\\..\\..\\..\\test

The directory test was successfully created.

06. ### Business Impact ###

This may allow an attacker to upload and download files from remote machine.

07. ### Systems Affected ###

This vulnerability was tested against: ColoradoFTP v1.3 Prime Edition 
(Build 8)
O.S.: Microsoft Windows 7 32bit
JDK: v1.7.0_79
Others versions are probably affected too, but they were not checked.

08. ### Vendor Information, Solutions and Workarounds ###

This issue is fixed in ColoradoFTP Prime Edition (Build 9),
which can be downloaded from:

http://cftp.coldcore.com/download.htm

09. ### Credits ###

Rv3Laboratory [Research Team] - www.Rv3Lab.org

This vulnerability has been discovered by:
Rv3Lab - [www.rv3lab.org] - research(at)rv3lab(dot)org
Christian Catalano aka wastasy - wastasy(at)rv3lab(dot)org
Marco Fornaro aka Chaplin89 - chaplin89(at)rv3lab(dot)org

10. ### Vulnerability History ###

July   07th, 2016: Vulnerability discovered.
July   19th, 2016: Vendor informed. [Colorado FTP team]
July   21st, 2016: Vendor responds asking for details.
July   28th, 2016: Sent detailed information to the vendor.
August 08th, 2016: Vendor confirms vulnerability.
August 10th, 2016: Vendor reveals patch release date.
August 11th, 2016: Vulnerability disclosure

11. ### Disclaimer ###

The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise.
We accept no responsibility for any damage caused by the use or misuse of
this information.

12. ### About Rv3Lab ###

Rv3Lab is an independent Security Research Lab.
For more information, please visit [www.Rv3Lab.org]
For more information regarding the vulnerability feel free to contact the
Rv3Research Team: research(at)rv3lab(dot)org

###################################################