27bb5a6384
1 new exploits WordPress Multiple Versions - Pwnpress Exploitation Tookit (0.2pub) WordPress Core 1.5.1.1 <= 2.2.2 - Multiple Vulnerabilities WordPress and Pyrmont 2.x - SQL Injection WordPress Pyrmont 2.x Plugin - SQL Injection WordPress Copperleaf Photolog 0.16 - SQL injection WordPress Copperleaf Photolog 0.16 Plugin - SQL injection WordPress 3.3.1 - Multiple Vulnerabilities WordPress Core 3.3.1 - Multiple Vulnerabilities WordPress 2.x - PHP_Self Cross-Site Scripting WordPress Core 2.x - PHP_Self Cross-Site Scripting WordPress 2.2 - Request_URI Parameter Cross-Site Scripting WordPress Core 2.2 - Request_URI Parameter Cross-Site Scripting WordPress MailPoet - (wysija-newsletters) Unauthenticated File Upload WordPress MailPoet Newsletters 2.6.8 Plugin - (wysija-newsletters) Unauthenticated File Upload Drupal Core 7.32 - SQL Injection (1) Drupal Core 7.0 <= 7.31 - SQL Injection (SA-CORE-2014-005) (1) Drupal Core 7.32 - SQL Injection (2) Drupal Core 7.0 <= 7.31 - SQL Injection (SA-CORE-2014-005) (2) Drupal < 7.32 Pre Auth SQL Injection Drupal Core < 7.32 - Pre Auth SQL Injection Live Wire 2.3.1 For WordPress - Multiple Security Vulnerabilities Wordpress Live Wire 2.3.1 Theme - Multiple Security Vulnerabilities The Gazette Edition 2.9.4 For WordPress - Multiple Security Vulnerabilities WordPress The Gazette Edition 2.9.4 Theme - Multiple Security Vulnerabilities WordPress Webdorado Spider Event Calendar 1.4.9 - SQL Injection WordPress Webdorado Spider Event Calendar 1.4.9 Plugin - SQL Injection WordPress Trending 0.1 - 'cpage' Parameter Cross-Site Scripting WordPress Trending 0.1 Theme - 'cpage' Parameter Cross-Site Scripting WordPress WPML - Multiple Vulnerabilities WordPress WPML 3.1.9 Plugin - Multiple Vulnerabilities WordPress 4.2 - Stored XSS WordPress Core 4.2 - Stored XSS WordPress RevSlider File Upload and Execute WordPress RevSlider 3.0.95 Plugin - File Upload and Execute WordPress MailChimp Subscribe Forms 1.1 Remote Code Execution WordPress MailChimp Subscribe Forms 1.1 - Remote Code Execution WordPress Track That Stat 1.0.8 Cross-Site Scripting WordPress Track That Stat 1.0.8 - Cross-Site Scripting WordPress Aviary Image Editor Add On For Gravity Forms 3.0 Beta Shell Upload WordPress Aviary Image Editor Add On For Gravity Forms 3.0 Beta - Shell Upload WordPress Wp-ImageZoom 'file' Parameter Remote File Disclosure WordPress Wp-ImageZoom - 'file' Parameter Remote File Disclosure WordPress Flip Book 'php.php' Arbitrary File Upload WordPress Flip Book - 'php.php' Arbitrary File Upload WordPress PHPFreeChat 'url' Parameter Cross-Site Scripting WordPress PHPFreeChat - 'url' Parameter Cross-Site Scripting WordPress Finder 'order' Parameter Cross-Site Scripting WordPress Finder - 'order' Parameter Cross-Site Scripting WordPress Multiple Path Dislosure Vulnerabilities WordPress Core 3.4.2 - Multiple Path Dislosure Vulnerabilities WordPress Video Gallery 2.7 SQL Injection WordPress Video Gallery 2.7 - SQL Injection WordPress Cross Site Request Forgery WordPress - Cross Site Request Forgery WordPress CStar Design 'id' Parameter SQL Injection WordPress CStar Design Theme - 'id' Parameter SQL Injection WordPress White-Label Framework 2.0.6 - XSS WordPress White-Label Framework 2.0.6 Theme - XSS WordPress NextGEN Gallery 'upload.php' Arbitrary File Upload WordPress NextGEN Gallery - 'upload.php' Arbitrary File Upload WordPress Xorbin Digital Flash Clock 'widgetUrl' Parameter Cross-Site Scripting WordPress Xorbin Digital Flash Clock - 'widgetUrl' Parameter Cross-Site Scripting WordPress Lead Octopus Power 'id' Parameter SQL Injection WordPress Lead Octopus Power - 'id' Parameter SQL Injection WordPress Booking Calendar Contact Form 1.1.24 - Multiple Vulnerabilities WordPress Booking Calendar Contact Form 1.1.24 - addslashes SQL Injection WordPress Booking Calendar Contact Form 1.1.24 Plugin - Multiple Vulnerabilities WordPress Booking Calendar Contact Form 1.1.24 Plugin - addslashes SQL Injection Wordpress Ultimate Product Catalog 3.9.8 - (do_shortcode via ajax) Blind SQL Injection Wordpress Ultimate Product Catalog 3.9.8 Plugin - (do_shortcode via ajax) Blind SQL Injection Wireshark 1.12.0 - 1.12.12 - NDS Dissector Denial of Service Wireshark 2.0.0 to 2.0.4 - MMSE_ WAP_ WBXML_ and WSP Dissectors Denial of Service Wireshark 1.12.0-1.12.12 - NDS Dissector Denial of Service Wireshark 2.0.0 - 2.0.4 - MMSE_ WAP_ WBXML_ and WSP Dissectors Denial of Service Microsoft Office Word 2007_2010_2013_2016 - Out-of-Bounds Read Remote Code Execution (MS16-099) Microsoft Office Word 2007/2010/2013/2016 - Out-of-Bounds Read Remote Code Execution (MS16-099) WebNMS Framework Server 5.2 and 5.2 SP1 - Multiple Vulnerabilities WebNMS Framework Server 5.2 / 5.2 SP1 - Multiple Vulnerabilities ColoradoFTP 1.3 Prime Edition (Build 8) - Directory Traversal
134 lines
4 KiB
Text
Executable file
134 lines
4 KiB
Text
Executable file
###################################################
|
|
|
|
01. ### Advisory Information ###
|
|
|
|
Title: Directory Traversal Vulnerability in ColoradoFTP v1.3 Prime
|
|
Edition (Build 8)
|
|
Date published: n/a
|
|
Date of last update: n/a
|
|
Vendors contacted: ColoradoFTP author Sergei Abramov
|
|
Discovered by: Rv3Laboratory [Research Team]
|
|
Severity: High
|
|
|
|
|
|
02. ### Vulnerability Information ###
|
|
|
|
OVE-ID: OVE-20160718-0006
|
|
CVSS v2 Base Score: 8.5
|
|
CVSS v2 Vector: (AV:N/AC:M/Au:S/C:C/I:C/A:C)
|
|
Component/s: ColoradoFTP Core v1.3
|
|
Class: Path Traversal
|
|
|
|
|
|
03. ### Introduction ###
|
|
|
|
ColoradoFTP is the open source Java FTP server. It is fast, reliable and
|
|
extendable.
|
|
Fully compatible with RFC 959 and RFC 3659 (File Transfer Protocol and
|
|
Extensions)
|
|
this implementation makes it easy to extend the functionality with
|
|
virtually any feature.
|
|
Well commented source code and existing plug-ins make it possible to
|
|
shape the
|
|
FTP server just the way you want!
|
|
|
|
http://cftp.coldcore.com/
|
|
|
|
04. ### Vulnerability Description ###
|
|
|
|
The default installation and configuration of Colorado FTP Prime Edition
|
|
(Build 8) is prone to a
|
|
security vulnerability. Colorado FTP contains a flaw that may allow a
|
|
remote attacker to traverse directories on the FTP server.
|
|
A remote attacker (a colorado FTP user) can send a command (MKDIR, PUT,
|
|
GET or DEL) followed by sequences (\\\..\\) to traverse directories
|
|
and create, upload, download or delete the contents of arbitrary files
|
|
and directories on the FTP server.
|
|
To exploit the vulnerability It is important to use "\\\" at the
|
|
beginning of string.
|
|
|
|
|
|
05. ### Technical Description / Proof of Concept Code ###
|
|
|
|
By supplying "\\\..\\..\\..\\..\\" in the file path, it is possible to
|
|
trigger a directory traversal flaw, allowing the attacker
|
|
(anonymous user or Colorado FTP user) to upload or download a file
|
|
outside the virtual directory.
|
|
|
|
|
|
05.01
|
|
We tried to upload a file (netcat - nc.exe), to Windows %systemroot%
|
|
directory (C:\WINDOWS\system32\) using a PUT command:
|
|
|
|
ftp> put nc.exe \\\..\\..\\..\\Windows\\system32\\nc.exe
|
|
|
|
Netcat was successfully uploaded.
|
|
|
|
|
|
05.02
|
|
We tried to create a directory (test), using a MKDIR command:
|
|
|
|
ftp> mkdir nc.exe \\\..\\..\\..\\test
|
|
|
|
The directory test was successfully created.
|
|
|
|
|
|
06. ### Business Impact ###
|
|
|
|
This may allow an attacker to upload and download files from remote machine.
|
|
|
|
|
|
07. ### Systems Affected ###
|
|
|
|
This vulnerability was tested against: ColoradoFTP v1.3 Prime Edition
|
|
(Build 8)
|
|
O.S.: Microsoft Windows 7 32bit
|
|
JDK: v1.7.0_79
|
|
Others versions are probably affected too, but they were not checked.
|
|
|
|
|
|
08. ### Vendor Information, Solutions and Workarounds ###
|
|
|
|
This issue is fixed in ColoradoFTP Prime Edition (Build 9),
|
|
which can be downloaded from:
|
|
|
|
http://cftp.coldcore.com/download.htm
|
|
|
|
|
|
09. ### Credits ###
|
|
|
|
Rv3Laboratory [Research Team] - www.Rv3Lab.org
|
|
|
|
This vulnerability has been discovered by:
|
|
Rv3Lab - [www.rv3lab.org] - research(at)rv3lab(dot)org
|
|
Christian Catalano aka wastasy - wastasy(at)rv3lab(dot)org
|
|
Marco Fornaro aka Chaplin89 - chaplin89(at)rv3lab(dot)org
|
|
|
|
|
|
10. ### Vulnerability History ###
|
|
|
|
July 07th, 2016: Vulnerability discovered.
|
|
July 19th, 2016: Vendor informed. [Colorado FTP team]
|
|
July 21st, 2016: Vendor responds asking for details.
|
|
July 28th, 2016: Sent detailed information to the vendor.
|
|
August 08th, 2016: Vendor confirms vulnerability.
|
|
August 10th, 2016: Vendor reveals patch release date.
|
|
August 11th, 2016: Vulnerability disclosure
|
|
|
|
|
|
11. ### Disclaimer ###
|
|
|
|
The information contained within this advisory is supplied "as-is" with
|
|
no warranties or guarantees of fitness of use or otherwise.
|
|
We accept no responsibility for any damage caused by the use or misuse of
|
|
this information.
|
|
|
|
|
|
12. ### About Rv3Lab ###
|
|
|
|
Rv3Lab is an independent Security Research Lab.
|
|
For more information, please visit [www.Rv3Lab.org]
|
|
For more information regarding the vulnerability feel free to contact the
|
|
Rv3Research Team: research(at)rv3lab(dot)org
|
|
|
|
###################################################
|