PT-2023-6216 · Titan Mft+1 · Titan Mft+1

Ron Bowes · Publicado 2023-10-16 · Atualizado 2023-10-24 · CVE-2023-45688

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Titan MFT and Titan SFTP servers (affected versions not specified)

Description The issue is related to insufficient path validation in the Titan MFT and Titan SFTP servers, allowing an authenticated attacker to obtain the size of an arbitrary file on the filesystem. This can be achieved through path traversal in the ftp "SIZE" command.

Recommendations For Titan MFT and Titan SFTP servers, consider restricting access to the ftp "SIZE" command until a patch is available. As a temporary workaround, limit the ability of authenticated attackers to perform path traversal attacks by implementing additional validation on file paths. Avoid using the ftp "SIZE" command with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-06925

CVE-2023-45688

Produtos afetados

Titan Mft

Titan Sftp

Referências · 9

• 🔥 https://rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed · Exploit
• https://t.me/cibsecurity/72323 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1714012043680890900 · Publicação no Twitter
• https://t.me/true_secator/4972 · Publicação no Telegram
• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45688 · Aviso do Fabricante
• https://vuldb.com/ru/?id.242292 · Nota
• https://bdu.fstec.ru/vul/2023-06925 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-45688 · Nota de Segurança