vsftpd <= 3.0.2 - Access Restriction Bypass

mediumseverity

5CVSS score

6.8%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

vsftpd 3.0.2 and earlier contain a vulnerability that allows remote attackers to bypass access restrictions due to improper parsing of the deny_file configuration directive.

Impact

Unauthenticated attackers can bypass access restrictions configured via the deny_file directive to access files that should be restricted, potentially exposing sensitive data on vsftpd servers.

Fix

Update vsftpd to a version newer than 3.0.2 that properly parses and enforces the deny_file configuration directive to prevent access restriction bypass.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'vsFTPd') and compare_versions(version, '<= 3.0.2')

Run it with nuclei: nuclei -id CVE-2015-1419 -u <target>

The full check

id: CVE-2015-1419

info:
  name: vsftpd <= 3.0.2 - Access Restriction Bypass
  author: pussycat0x
  severity: medium
  description: |
    vsftpd 3.0.2 and earlier contain a vulnerability that allows remote attackers to bypass access restrictions due to improper parsing of the deny_file configuration directive.
  impact: |
    Unauthenticated attackers can bypass access restrictions configured via the deny_file directive to access files that should be restricted, potentially exposing sensitive data on vsftpd servers.
  remediation: |
    Update vsftpd to a version newer than 3.0.2 that properly parses and enforces the deny_file configuration directive to prevent access restriction bypass.
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
    cvss-score: 5
    cve-id: CVE-2015-1419
    epss-score: 0.06787
    epss-percentile: 0.94045
    cpe: cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: opensuse
    product: opensuse
    shodan-query: "vsFTPd"
  tags: cve,cve2015,network,ftp,vsftpd,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'vsFTPd')"
          - "compare_versions(version, '<= 3.0.2')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "vsFTPd ([0-9.]+)"

Use this check only on systems you are authorised to test. Where the data comes from