commons-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Toshitsugu Yoneyama (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (NET-647) FTP Command Injection
Date Mon, 11 Dec 2017 03:11:00 GMT

     [ https://issues.apache.org/jira/browse/NET-647?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Toshitsugu Yoneyama updated NET-647:
------------------------------------
    Environment:     (was: Vulnerable program example(ftpClient.java)
---------------------------------------------------------
private static final String username = "test";  // ftp user name
private static final String password = "test";  // ftp user password

FTPClient ftp = new FTPClient();
FTPClientConfig config = new FTPClientConfig();

ftp.configure(config);
boolean error = false;

try {
	int reply;
	String server = "localhost";   // terget ip address
        ftp.connect(server);
        System.out.println("Connected to " + server + ".");
        System.out.println(ftp.getReplyString());

        ftp.login(username, password);      
        
        String path = "test"   //  <= FTP command injection.
        ftp.changeWorkingDirectory(path);
        ...(snip)...
---------------------------------------------------------)
    Description: 
Vulnerable program example(ftpClient.java)
---------------------------------------------------------
private static final String username = "test";  // ftp user name
private static final String password = "test";  // ftp user password

FTPClient ftp = new FTPClient();
FTPClientConfig config = new FTPClientConfig();

ftp.configure(config);
boolean error = false;

try {
	int reply;
	String server = "localhost";   // terget ip address
        ftp.connect(server);
        System.out.println("Connected to " + server + ".");
        System.out.println(ftp.getReplyString());

        ftp.login(username, password);      
        
        String path = "test"   //  <= FTP command injection.
        ftp.changeWorkingDirectory(path);
        ...(snip)...
---------------------------------------------------------

It does not check path in changeWorkingDirectory().
So I can inject to FTP Command and I can do "FTP Bounce Attack", OS command injection from
SITE command, and up/download malicious file.

For example:
 String path = "test\r\nNOOP"  //  <= FTP command injection.

I suggest to this patch.

[before]
public boolean changeWorkingDirectory(String pathname) throws IOException {
    return FTPReply.isPositiveCompletion(cwd(pathname));
}

[aftter]
public boolean changeWorkingDirectory(String pathname) throws IOException {
    String separator = "\r\n|[\n\r\u2028\u2029\u0085]";
    String paths[] =  pathname.split(separator); 
    return FTPReply.isPositiveCompletion(cwd(paths[0]));
}

Best regards,

  was:
It does not check path in changeWorkingDirectory().
So I can inject to FTP Command and I can do "FTP Bounce Attack", OS command injection from
SITE command, and up/download malicious file.

For example:
 String path = "test\r\nNOOP"  //  <= FTP command injection.

I suggest to this patch.

[before]
public boolean changeWorkingDirectory(String pathname) throws IOException {
    return FTPReply.isPositiveCompletion(cwd(pathname));
}

[aftter]
public boolean changeWorkingDirectory(String pathname) throws IOException {
    String separator = "\r\n|[\n\r\u2028\u2029\u0085]";
    String paths[] =  pathname.split(separator); 
    return FTPReply.isPositiveCompletion(cwd(paths[0]));
}

Best regards,


> FTP Command Injection 
> ----------------------
>
>                 Key: NET-647
>                 URL: https://issues.apache.org/jira/browse/NET-647
>             Project: Commons Net
>          Issue Type: Bug
>          Components: FTP
>    Affects Versions: 3.4, 3.5, 3.6
>            Reporter: Toshitsugu Yoneyama
>            Priority: Critical
>              Labels: security
>   Original Estimate: 168h
>  Remaining Estimate: 168h
>
> Vulnerable program example(ftpClient.java)
> ---------------------------------------------------------
> private static final String username = "test";  // ftp user name
> private static final String password = "test";  // ftp user password
> FTPClient ftp = new FTPClient();
> FTPClientConfig config = new FTPClientConfig();
> ftp.configure(config);
> boolean error = false;
> try {
> 	int reply;
> 	String server = "localhost";   // terget ip address
>         ftp.connect(server);
>         System.out.println("Connected to " + server + ".");
>         System.out.println(ftp.getReplyString());
>         ftp.login(username, password);      
>         
>         String path = "test"   //  <= FTP command injection.
>         ftp.changeWorkingDirectory(path);
>         ...(snip)...
> ---------------------------------------------------------
> It does not check path in changeWorkingDirectory().
> So I can inject to FTP Command and I can do "FTP Bounce Attack", OS command injection
from SITE command, and up/download malicious file.
> For example:
>  String path = "test\r\nNOOP"  //  <= FTP command injection.
> I suggest to this patch.
> [before]
> public boolean changeWorkingDirectory(String pathname) throws IOException {
>     return FTPReply.isPositiveCompletion(cwd(pathname));
> }
> [aftter]
> public boolean changeWorkingDirectory(String pathname) throws IOException {
>     String separator = "\r\n|[\n\r\u2028\u2029\u0085]";
>     String paths[] =  pathname.split(separator); 
>     return FTPReply.isPositiveCompletion(cwd(paths[0]));
> }
> Best regards,



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

Mime
View raw message