| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. 15201.mp4: They prioritize system-readable data over catchy titles. : They provide visual proof for technical troubleshooting. 15201.mp4 : They serve as digital markers for physical locations (like the trendy Lawrenceville neighborhood in Pittsburgh). : They prioritize system-readable data over catchy titles If you are looking for a or need to create a feature for a certain industry (like tech support or real estate), let me know: Are you referring to a specific software bug or tutorial ? Is this for a real estate listing in a specific zip code? If you are looking for a or need While may look like a random string of numbers, it often appears in professional contexts as a specific file identifier, most notably in technical bug reports and real estate showcases. The Mystery of the Digital Artifact Files like these remind us that behind every generic "mp4" tag is a story of :
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |