[vuln.sg] ESTsoft ALFTP FTP Client Directory Traversal Vulnerability

A vulnerability has been found within the FTP client in ESTsoft ALFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

This advisory discloses a vulnerability within the FTP client in ESTsoft ALFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

The FTP client does not properly sanitise filenames containing directory traversal sequences (backslash and forward-slash) that are received from an FTP server in response to the LIST command.

Response to LIST (backslash):

-rw-r--r--    1 ftp      ftp            20 Mar 01 05:37 \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):

-rw-r--r--    1 ftp      ftp            20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

By tricking a user to download a directory from a malicious FTP server that contains files with directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Startup folder and execute arbitrary code when the user logs on.

Instructions for testing FTP client:

Unzip the POC file into a directory. This gives ALFTPPOC.exe and ALFTPPOC-forward.exe.
ALFTPPOC.exe is a POC FTP server that will send filenames with backslash directory traversal characters in response to LIST commands.
ALFTPPOC-forward.exe is a POC FTP server that will send filenames with forward-slash directory traversal characters in response to LIST commands.
Go to the command prompt and run ALFTPPOC.exe or ALFTPPOC-forward.exe on a system. It will listen on FTP Port 21.

IMPORTANT: Ensure that ALFTP is configured to use Passive mode. The POC FTP server only supports Passive mode.
Use ALFTP to connect to the POC FTP server. You can use any username/password.
You'll see a directory named /testdir on the POC FTP server (see below).

If you traverse into that directory you'll see a file (testfile.txt) with directory traversal characters in its filename (see below).

Now, if you attempt to download the /testdir directory into C:\aaaa\bbbb\cccc\etc, you'll notice that testfile.txt will be written into C:\ instead of into C:\aaaa\bbbb\cccc\etc\testdir\testfile.txt.

Hence, by tricking a user to download a directory from a malicious FTP server, an attacker can potentially leverage this issue to write files into a user's Startup folder and execute arbitrary code when the user logs on.

2008-05-18 - Vulnerability Discovered.
2008-05-22 - Vulnerability Details Sent to Vendor (no reply).
2008-05-27 - First Vendor Reminder (no reply).
2008-05-29 - Second Vendor Reminder (no reply).
2008-06-02 - Final Vendor Reminder (no reply).
2008-06-06 - Public Release.
2010-05-19 - Informed by vendor that vulnerability was fixed in version 5.1 beta 1 (released 2008-09-09).
2010-05-22 - Tested version 5.2 (English) and confirmed that it was fixed.