Mailing-List: contact issues-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: issues@commons.apache.org
Date: Mon, 11 Dec 2017 10:32:00 +0000 (UTC)
From: "Sebb (JIRA)" <jira@apache.org>
To: issues@commons.apache.org
Message-ID: <JIRA.13124043.1512961777000.428788.1512988320329@Atlassian.JIRA>
In-Reply-To: <JIRA.13124043.1512961777000@Atlassian.JIRA>
References: <JIRA.13124043.1512961777000@Atlassian.JIRA> <JIRA.13124043.1512961777568@jira-lw-us.apache.org>
Subject: [jira] [Updated] (NET-647) FTP Command Injection
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 11 Dec 2017 10:32:05 -0000


     [ https://issues.apache.org/jira/browse/NET-647?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Sebb updated NET-647:
---------------------
    Issue Type: Improvement  (was: Bug)

> FTP Command Injection 
> ----------------------
>
>                 Key: NET-647
>                 URL: https://issues.apache.org/jira/browse/NET-647
>             Project: Commons Net
>          Issue Type: Improvement
>          Components: FTP
>    Affects Versions: 3.4, 3.5, 3.6
>            Reporter: Toshitsugu Yoneyama
>            Priority: Critical
>   Original Estimate: 168h
>  Remaining Estimate: 168h
>
> Vulnerable program example(ftpClient.java)
> ---------------------------------------------------------
> private static final String username = "test";  // ftp user name
> private static final String password = "test";  // ftp user password
> FTPClient ftp = new FTPClient();
> FTPClientConfig config = new FTPClientConfig();
> ftp.configure(config);
> boolean error = false;
> try {
> 	int reply;
> 	String server = "localhost";   // terget ip address
>         ftp.connect(server);
>         System.out.println("Connected to " + server + ".");
>         System.out.println(ftp.getReplyString());
>         ftp.login(username, password);      
>         
>         String path = "test"   //  <= FTP command injection.
>         ftp.changeWorkingDirectory(path);
>         ...(snip)...
> ---------------------------------------------------------
> It does not check path in changeWorkingDirectory().
> So I can inject to FTP Command and I can do "FTP Bounce Attack", OS command injection from SITE command, and up/download malicious file.
> For example:
>  String path = "test\r\nNOOP"  //  <= FTP command injection.
> I suggest to this patch.
> [before]
> public boolean changeWorkingDirectory(String pathname) throws IOException {
>     return FTPReply.isPositiveCompletion(cwd(pathname));
> }
> [aftter]
> public boolean changeWorkingDirectory(String pathname) throws IOException {
>     String separator = "\r\n|[\n\r\u2028\u2029\u0085]";
>     String paths[] =  pathname.split(separator); 
>     return FTPReply.isPositiveCompletion(cwd(paths[0]));
> }
> Best regards,


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)