pyftpdlib Symlink Directory Traversal Vulnerability
BID:44333
Info
pyftpdlib Symlink Directory Traversal Vulnerability
| Bugtraq ID: | 44333 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-7262 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2007 12:00AM |
| Updated: | Nov 26 2007 12:00AM |
| Credit: | billiejoex |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
pyftpdlib Symlink Directory Traversal Vulnerability
pyftpdlib is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploits would allow an attacker to access files outside of the user's root directory to obtain sensitive information and perform other attacks.
To exploit this issue, attackers require authenticated access to the FTP server. Note that this issue may be exploited through a writable share accessible by guest accounts.
pyftpdlib is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploits would allow an attacker to access files outside of the user's root directory to obtain sensitive information and perform other attacks.
To exploit this issue, attackers require authenticated access to the FTP server. Note that this issue may be exploited through a writable share accessible by guest accounts.
Exploit / POC
pyftpdlib Symlink Directory Traversal Vulnerability
An attacker can exploit this issue using standard commands and readily available tools.
An attacker can exploit this issue using standard commands and readily available tools.