PT-2017-13957 · Psftpd · Psftpd

Eric Sesterhenn + 1 · Publicado 2017-11-15 · Atualizado 2018-10-09 · CVE-2017-15270

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PSFTPd version 10.0.4 Build 729

Description The issue allows attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent by not properly escaping data before writing it into a Comma Separated Values (CSV) file. Special characters such as ", , and r are not escaped and can be used to add new entries to the log.

Recommendations For PSFTPd version 10.0.4 Build 729, consider implementing proper data escaping before writing to CSV files to prevent the addition of arbitrary log entries. As a temporary workaround, restrict the use of special characters in input data to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-15270

Produtos afetados

Psftpd

Referências · 6

• 🔥 https://exploit-db.com/exploits/43144 · Exploit
• http://securityfocus.com/archive/1/541518/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15270 · Nota de Segurança
• https://x41-dsec.de/lab/advisories/x41-2017-006-psftpd · Nota
• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html · Nota
• https://osv.dev/vulnerability/CVE-2017-15270 · Aviso do Fabricante