CVE-2018-18370 in ASG
Summary
by MITRE
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2020
The CVE-2018-18370 vulnerability represents a critical cross-site scripting flaw within the WebFTP mode of F5's ASG/ProxySG appliances, specifically affecting versions 6.6 and 6.7 prior to 6.7.4.2 and ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. This vulnerability operates within the context of FTP proxy functionality where users access remote FTP servers through web browsers using ftp:// URLs, creating a unique attack surface that bridges traditional file transfer protocols with web-based proxy operations.
The technical flaw manifests as a stored XSS vulnerability in the WebFTP mode implementation, where the proxy appliance's web interface fails to properly sanitize or escape user-supplied data when displaying directory listings from remote FTP servers. When a user navigates to an FTP server through the proxy's WebFTP mode, the appliance fetches directory listings and presents them in a web interface, but does not adequately filter or encode special characters in filenames or directory names that might contain malicious JavaScript code. This allows attackers who can upload crafted files to the target FTP server to inject persistent XSS payloads that execute in the context of other users' browsers when they view the affected directory listings.
The operational impact of this vulnerability extends beyond simple browser-based attacks, as it enables attackers to potentially execute arbitrary code within the context of authenticated users' browsers, potentially leading to session hijacking, credential theft, or further exploitation of the victim's browser environment. The attack requires the attacker to have upload access to the target FTP server, making it a privilege escalation or lateral movement vector rather than a direct remote code execution vulnerability. However, the implications are significant as it allows attackers to compromise users who access the FTP server through the vulnerable proxy appliance, particularly in enterprise environments where such proxies are commonly deployed for network traffic control and monitoring.
From a cybersecurity framework perspective, this vulnerability maps to CWE-79 "Cross-site Scripting" and aligns with ATT&CK technique T1059.007 "Command and Scripting Interpreter: JavaScript,' and represents a classic case of insecure data handling in web applications. The vulnerability demonstrates the importance of proper input validation and output encoding in proxy and web-based security appliances, as these systems often serve as intermediaries between users and potentially malicious content, making them attractive targets for attackers seeking to establish persistent access or execute more sophisticated attacks.
Organizations affected by this vulnerability should immediately apply the vendor-provided patches and updates for their ASG/ProxySG appliances, particularly focusing on the version-specific fixes for 6.5.10.15, 6.6, and 6.7.4.2 releases. Network administrators should also implement monitoring for unusual FTP upload activities and consider implementing additional security controls such as web application firewalls or content filtering rules that can detect and block known XSS patterns in proxy-generated web interfaces. The vulnerability highlights the necessity of comprehensive security testing for proxy and interception appliances, particularly those handling user-facing web interfaces that display data from external sources, as these systems often become attack vectors when proper sanitization controls are not implemented.