PT-2020-12794 · Zftpserver+1 · Provide+1

Published 2020-04-12 · Updated 2021-07-21 · CVE-2020-11707

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProVide (formerly zFTPServer) versions through 13.1

Description An issue was discovered where the software does not enforce permission over Windows Symlinks or Junctions. This allows a low-privileged user to craft a Junction Link in a directory they have full control of, breaking out of the sandbox.

Recommendations For ProVide (formerly zFTPServer) versions through 13.1, consider restricting access to Windows Symlinks or Junctions to prevent low-privileged users from crafting malicious links. As a temporary workaround, limit the ability of non-admin users to create Junction Links in directories they control. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-11707

Affected Products

Provide

Windows

References · 5

• 🔥 https://github.com/belong2yourself/vulnerabilities/tree/master/ProVide/Sandbox%20Escape%20via%20Symlink%20or%20Junction · Exploit
• https://provideserver.com/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11707 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11707 · Vendor Advisory
• https://t.me/cvenotify/2662 · Telegram Post