CoreFTP FTP/SFTP Server 2.0 Build 674 MDTM Command path traversal

Summaryinfo

A vulnerability classified as problematic has been found in CoreFTP FTP and SFTP Server 2.0 Build 674. This affects an unknown part of the component MDTM Command Handler. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2019-9649. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability was found in CoreFTP FTP and SFTP Server 2.0 Build 674 (SSH Server Software) and classified as problematic. This issue affects some unknown processing of the component MDTM Command Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality.

The bug was discovered 03/11/2019. The weakness was disclosed 03/11/2019 by Kevin Randall as CVE-2019-9649 CoreFTP FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2019-9649 since 03/10/2019. The attack may be initiated remotely. Required for exploitation is a simple authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

A public exploit has been developed by Kevin Randall and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The code used by the exploit is:

#nc -nv 192.168.0.2 21
(UNKNOWN) [192.168.0.2] 21 (ftp) open
220 Core FTP Server Version 2.0, build 674, 32-bit, installed 1 days ago
Unregistered
USER anonymous
331 password required for anonymous
PASS anonymous@
230-Logged on
230
MDTM C:\..\..\..\..\..\..\Windows\System32\ARP.exe
213 20090713211412

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-132112 is pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• SSH Server Software

Vendor

• CoreFTP

Name

• FTP
• SFTP Server

Version

• 2.0 Build 674

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion