CVE-2018-18371 in ASG
Summary
by MITRE
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2020
The CVE-2018-18371 vulnerability resides within the Application Security Gateway (ASG) and ProxySG firewall appliances, specifically affecting their FTP proxy functionality in WebFTP mode. This vulnerability represents a critical information disclosure flaw that occurs when users access FTP servers through web browsers using ftp:// URLs. The affected systems include ASG versions 6.6 and 6.7 prior to 6.7.4.2, and ProxySG versions 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2, creating a substantial attack surface across multiple product lines and version ranges.
The technical flaw manifests in the WebFTP mode implementation where the proxy appliance intercepts FTP connections and presents a web-based listing of the remote FTP server contents. During this process, the system inadvertently exposes plaintext authentication credentials within the web interface, allowing malicious actors to extract usernames and passwords through simple web browsing activities. This occurs because the proxy does not properly sanitize or separate authentication information from the web listing interface, creating an information exposure condition that violates fundamental security principles. The vulnerability is classified as CWE-209, Information Exposure Through an Error Message, and more specifically aligns with CWE-312, Cleartext Storage of Sensitive Information, as credentials are stored and transmitted in plaintext format.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables attackers to gain unauthorized access to remote FTP servers with the stolen credentials. This creates a potential for lateral movement within networks, data exfiltration, and persistent access to sensitive systems that rely on FTP for file transfers. The vulnerability is particularly concerning because it operates transparently through normal web browsing activities, making detection difficult and exploitation straightforward for attackers with basic network reconnaissance capabilities. From an adversarial perspective, this vulnerability maps directly to ATT&CK technique T1078.002, Valid Accounts: Default Accounts, and T1566.001, Phishing: Spearphishing Attachment, as attackers can leverage stolen credentials to maintain access to target systems.
Organizations affected by this vulnerability should implement immediate mitigations including upgrading to patched versions of ASG and ProxySG software, specifically versions 6.7.4.2 for ASG and the corresponding ProxySG patches. Network administrators should also consider disabling WebFTP mode if it is not essential for business operations, implementing additional network segmentation, and monitoring for suspicious web browsing activities that may indicate exploitation attempts. The vulnerability demonstrates the importance of proper input validation and output sanitization in proxy appliances, as well as the need for comprehensive security testing of web-based administrative interfaces. Organizations should also review their overall FTP usage policies and consider migrating to more secure protocols such as SFTP or FTPS where possible to reduce the attack surface and mitigate similar vulnerabilities in the future.