CVE-2003-1380 in BisonFTP Server
Summary
by MITRE
Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an ls @../ command, or (2) list files above the root via a "mget @../FILE" command.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/14/2025
The vulnerability identified as CVE-2003-1380 represents a critical directory traversal flaw in the BisonFTP Server 4 release 2 implementation. This security weakness stems from inadequate input validation within the file listing and retrieval commands, specifically affecting the ls and mget functions that handle special character sequences. The vulnerability enables malicious actors to escape the designated root directory boundaries and access files or directories outside the intended scope of the FTP server's file system hierarchy.
The technical exploitation of this vulnerability occurs through the use of the symbol combined with relative path traversal sequences such as ../ in command execution. When the BisonFTP server processes these commands, it fails to properly sanitize or validate the input paths, allowing attackers to manipulate the file system access through the FTP protocol interface. This flaw directly relates to CWE-22, which defines improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. The vulnerability specifically manifests in the server's handling of commands that reference files or directories above the root directory, creating a potential information disclosure and unauthorized access vector.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with the capability to enumerate and potentially retrieve sensitive files from the underlying file system. Remote attackers can leverage this weakness to access system files, configuration data, user documents, and potentially confidential information stored on the server. The ability to list directories above the root directory through the ls ../ command demonstrates a fundamental breakdown in access control mechanisms, while the mget ../FILE command enables active data exfiltration. This vulnerability can be exploited without authentication in many cases, making it particularly dangerous for systems where FTP services are exposed to untrusted networks.
Security professionals should implement immediate mitigations including updating to patched versions of the BisonFTP Server software, implementing proper input validation and sanitization for all FTP commands, and configuring access controls to limit directory traversal capabilities. Network segmentation and firewall rules should be employed to restrict access to FTP services, while monitoring should be enabled to detect suspicious command sequences. The vulnerability aligns with ATT&CK technique T1213.002, which describes data from information repositories, as attackers can extract data through the compromised FTP server. Additionally, this vulnerability exemplifies the broader category of insecure direct object references, where the system fails to properly validate user-supplied input before using it to access system resources. Organizations should also consider implementing Web Application Firewalls or similar protective measures to detect and block malicious traversal attempts before they can be executed against vulnerable FTP implementations.