#=cicatriz =#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~(advisories)=# /) /) /) _ _ _______(/ ________ // _ (/_ _ _____ _ (/__(_)(_)(_(_(_)(_) (/_(_(_/_) /_)_ o (_)/ (_(_/_ .-/ #=net2ftp <= 0.97 Cross-Site Scripting/Request Forgery=#=~~~~~~~~~~~~~~~(_/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=Advisory & Vulnerability Information=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# Title: net2ftp <= 0.97 Cross-Site Scripting/Request Forgery Advisory ID: VUDO-2009-0804 Advisory URL: http://research.voodoo-labs.org/advisories/3 Date founded: 2009-04-02 Vendors contacted: net2ftp Class: Multiple Vulnerabilities Remotely Exploitable: Yes Localy Exploitable: No Exploit/PoC Available: Yes Policy: Full Disclosure Policy (RFPolicy) v2.0 #=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=Tested & Vulnerable packages=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# [+] net2ftp 0.97 [+] net2ftp 0.95 Beta: [*] net2ftp 0.98 beta #=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=Solutions and Workarounds=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# The vendor didn't released any fix/update. #=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=Technical Information=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# Multiple vulnerabilities were found on the package net2ftp [1], version 0.98 and below. Two types of vulnerabilities were found: Cross-Site Scripting and Cross-Site Request Forgery. [*] Cross-Site Scripting (XSS): This vulnerability it's produced by a "typo" in the function validateGeneriInput(), where the extraction of characters < and > fails because the regular expression in charge of the extraction it's invalid. +++includes/registerglobals.inc.php @@ 1088:1102 1088 function validateGenericInput($input) { 1089 1090 // -------------- 1091 // Remove the following characters <> 1092 // -------------- 1093 1094 // Remove XSS code 1095 // $input = RemoveXSS($input); 1096 1097 // Remove < > XXX 1098 $input = preg_replace("/\\<\\>]/", "", $input); 1099 1100 return $input; 1101 1102 } // end validateGenericInput ---includes/registerglobals.inc.php This can be easily fixed adding a "[" character to the pattern: +++ $input = preg_replace("/[\\<\\>]/", "", $input); --- [*] Cross-Site Request Forgery (CSRF): All the forms on the web application are vulnerable because they doesn't check any type of token to ensure that the user submited the form. So an attacker can trick the user to visit a website with this type of method and perform certain actions on the server, like create files, delete/rename/upload/etc. #=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# #=Proof of Concept=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=# [*] Cross-Site Scripting (XSS): +++ http://ftp.victim.com/?state=login_small&errormessage=

Query Builder