[vuln.sg] FFFTP FTP-Client Directory Traversal Vulnerability

A vulnerability has been found in FFFTP FTP-client. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

This advisory discloses a vulnerability in FFFTP FTP-client. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command.

Response to LIST (forward slash):

-rw-r--r--  1 502   502     4096 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

By tricking a user to download a directory from a malicious FTP server that contains files with forward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Startup folder and execute arbitrary code when the user logs on.

Instructions:

Unzip the POC file into a directory. This gives FFFTPPOC-forward.exe.
FFFTPPOC-forward.exe is a POC FTP server that will send filenames with foward-slash directory traversal characters in response to LIST commands.
Go to the command prompt and run FFFTPPOC-forward.exe on a system. It will listen on FTP Port 21.

Ensure that FFFTP is configured to use Passive mode.
Use FFFTP to connect to the POC FTP server. You can use any username/password.
You'll see a directory named /testdir on the POC FTP server (see below).

If you traverse into that directory you'll see a file (testfile.txt) with directory traversal characters in its filename (see below).

Now, if you attempt to download the /testdir directory into C:\aaaa\bbbb\cccc\etc, you'll notice that testfile.txt will be written into C:\ instead of into C:\aaaa\bbbb\cccc\etc\testdir\testfile.txt.

Hence, by tricking a user to download a directory from a malicious FTP server, an attacker can potentially leverage this issue to write files into a user's Startup folder and execute arbitrary code when the user logs on.

The vulnerability will be fixed in a future version. In the meantime, avoid downloading files/directories from untrusted FTP servers.

2008-05-24 - Vulnerability Discovered.
2008-05-25 - Initial Vendor Notification.
2008-05-25 - Received reply from vendor that vulnerability will be fixed in a future version.
2008-05-31 - Public Release.