ProFTPD < 1.3.3c - Directory Traversal via mod_site_misc

highseverity

7.1CVSS score

7.6%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

ProFTPD versions before 1.3.3c contain directory traversal vulnerabilities in the mod_site_misc module. The vulnerability allows attackers to traverse directories and potentially overwrite arbitrary files on the system through crafted input to commands like SITE MKDIR and other SITE commands.

Impact

Authenticated attackers can exploit directory traversal in mod_site_misc module through SITE MKDIR and other SITE commands to traverse directories and overwrite arbitrary files on the ProFTPD server.

Fix

Update ProFTPD to version 1.3.3c or later that properly validates paths in mod_site_misc module and prevents directory traversal attacks.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'ProFTPD') and compare_versions(version, '< 1.3.3c')

Run it with nuclei: nuclei -id CVE-2010-3867 -u <target>

The full check

id: CVE-2010-3867

info:
  name: ProFTPD < 1.3.3c - Directory Traversal via mod_site_misc
  author: pussycat0x
  severity: high
  description: |
    ProFTPD versions before 1.3.3c contain directory traversal vulnerabilities in the mod_site_misc module. The vulnerability allows attackers to traverse directories and potentially overwrite arbitrary files on the system through crafted input to commands like SITE MKDIR and other SITE commands.
  impact: |
    Authenticated attackers can exploit directory traversal in mod_site_misc module through SITE MKDIR and other SITE commands to traverse directories and overwrite arbitrary files on the ProFTPD server.
  remediation: |
    Update ProFTPD to version 1.3.3c or later that properly validates paths in mod_site_misc module and prevents directory traversal attacks.
  reference:
    - http://bugs.proftpd.org/show_bug.cgi?id=3519
    - http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050687.html
    - http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050703.html
    - http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050726.html
    - http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.498209
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:H/Au:S/C:C/I:C/A:C
    cvss-score: 7.1
    cve-id: CVE-2010-3867
    cwe-id: CWE-22
    epss-score: 0.07563
    epss-percentile: 0.94572
    cpe: cpe:2.3:a:proftpd:proftpd:1.2.10:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: proftpd
    product: proftpd
    shodan-query:
      - product:"proftpd"
      - cpe:"cpe:2.3:a:proftpd:proftpd"
  tags: cve,cve2010,network,ftp,proftpd,tcp,passive,lfi,vuln
tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'ProFTPD')"
          - "compare_versions(version, '< 1.3.3c')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "ProFTPD ([0-9.a-z]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from