[vuln.sg] net2ftp Web-based FTP-Client Archive Handling Directory Traversal

A vulnerability has been found within the archive extraction functionality of net2ftp. When exploited, this vulnerability allows an anonymous attacker to retrieve and potentially delete files from the web server where net2ftp is hosted. Execution of arbitrary PHP code is also possible if the web server directory is writable.

This advisory discloses a vulnerability within the archive extraction functionality of net2ftp. When exploited, this vulnerability allows an anonymous attacker to retrieve and potentially delete files from the web server where net2ftp is hosted. Execution of arbitrary PHP code is also possible if the web server directory is writable.

The net2ftp web-based FTP client allows the user to connect to an FTP server and to extract a TAR/ZIP file on the FTP server in a few simple steps. It does this in the following way.

A malicious user can create a specially-crafted TAR/ZIP archive that contains files with directory traversal sequences in their filenames. When such an archive is extracted by net2ftp, it can cause net2ftp to upload arbitrary files from the web server to the FTP server, with privileges for the web server process.

In addition, the files will be extracted outside of the temp directory. By creating a specially-craft TAR/ZIP archive that causes PHP files to be extracted into the web server directory (via directory traversal sequences in their filenames), arbitrary code execution on the web server is possible. An example of such an archive is shown below.

Extracting such an archive with net2ftp will cause net2ftp to upload "/documentroot/net2ftp_root/temp/unzip__xxxxxxxxx/../../../../../../../../../../../../../../../../../../etc/passwd" to the FTP server.

This allows an attacker to steal /etc/passwd or any other files that are accessible to the web server process. For example, by stealing "settings.inc.php", an attacker will be able to find out the net2ftp admin username and password. Note that if net2ftp is hosted on a Windows-based web server, the backslash directory traveral sequence ..\ can also be used.

In addition, after the file is uploaded to the FTP server, net2ftp will attempt to delete that file. This means that if the web server process has write access to that file, it will be deleted.

To allow execution of arbitrary PHP code, the attacker must be able to access the extracted PHP file before net2ftp completes its upload to the FTP server and deletes the file. This can be archived by creating a specially-craft FTP server that sleeps for 10 seconds before completing the STOR request from net2ftp. This delay should give the attacker sufficient time to access the extracted PHP file before it is deleted.

The screenshot below shows net2ftp attempted to delete /etc/passwd after uploading it to the FTP server.

Preparations for testing:

Deploy net2ftp on a Linux test system with Apache web server.
Ensure that you do not apply any additional security features like chroot, PHP "Safe mode", etc.
Ensure that /etc/passwd is read-only by the Apache web server process. Warning: If /etc/passwd is writable by the Apache web server process, it will be deleted.
Enable "display_errors" in php.ini and restart Apache web server.

Instructions for testing FTP client:

Unzip the POC file into an empty directory. This gives net2ftpPOC.exe.
net2ftpPOC.exe is a POC FTP server that contains a two hardcoded specially-crafted TAR and ZIP archives. These two archives will "steal" /etc/passwd when extracted.
net2ftpPOC.exe will also be receiving the "stolen" /etc/passwd file.
NOTE: Do NOT run net2ftpPOC.exe on a system that is connected to an untrusted public network. This POC FTP server does not perform any authentication and access-control restrictions!
Go to the command prompt and run net2ftpPOC.exe on a Windows system. It will listen on FTP Port 21.

IMPORTANT: Ensure that net2ftp is configured to use Passive mode. The POC FTP server only supports Passive mode.
Use net2ftp to connect to the POC FTP server. You can use any username/password.
You'll see a two archives on the POC FTP server, testzip.zip and testtar.tar (see below).

Select testzip.zip OR testtar.tar by clicking on the checkbox beside them.
Click on the "Unzip" button and specify / as the target directory. (see below)

Submit the request to net2ftp. If error reporting is enabled in PHP, you will see the unlink error (earlier screenshot) as the result. At the same time, you will see /etc/passwd being uploaded to the POC FTP server (see below).

View the "passwd" file that was saved to same directory as net2ftpPOC.exe to confirm that it was from the server that hosts net2ftp.

2008-06-05 - Vulnerability Discovered.
2008-06-06 - Vulnerability Details Sent to Vendor.
2008-06-09 - Vendor Reminder Sent.
2008-06-09 - Vendor releases fixed version.
2008-06-11 - Limited Information Public Disclosure.
2008-06-17 - Updated advisory with vulnerability information.