| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Nearest-walmart-grocery-store Link: A major French hypermarket chain that operates several large stores in and around Moscow, including those in MEGA malls. It is considered the closest direct competitor to the Walmart Supercenter model in Russia. The Russian retail market is highly competitive and dominated by local brands. Below are the most prominent options for general grocery needs: Chain Name Key Feature Hypermarket Largest selection; similar to Walmart Supercenter Perekrestok Supermarket Widespread; reliable quality and delivery Magnit / Pyaterochka Discounter Affordable and located in almost every neighborhood VkusVill Focuses on healthy, organic, and "clean label" products nearest-walmart-grocery-store If you are located in or near the , you can find the following high-quality grocery and hypermarket options: : A major French hypermarket chain that operates : A popular European chain with approximately 200 locations in Russia. These stores offer a wide variety of fresh produce, meat, seafood, and imported goods in a format familiar to Western shoppers. Below are the most prominent options for general : A premium supermarket chain known for high-quality service and a large selection of international delicacies. Many locations operate 24/7 , including those near the city center.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |