CVE-2017-7418

Severity Score

5.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.

ProFTPD en versiones anteriores a 1.3.5e y 1.3.6 en versiones anteriores a 1.3.6rc5 controlan si el directorio de inicio de un usuario puede contener un enlace simbólico hasta la versión de la opción de configuración AllowChrootSymlinks, pero comprueba sólo el último componente de ruta al aplicar AllowChrootSymlinks. Los atacantes con acceso local pueden omitir el control AllowChrootSymlinks reemplazando un componente de ruta (que no sea el último) con un enlace simbólico. El modelo de amenaza incluye un atacante al que no se concede acceso completo al sistema de archivos por parte de un proveedor de alojamiento, pero puede reconfigurar el directorio de inicio de un usuario FTP.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-04-04 CVE Reserved
2017-04-04 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CAPEC

References (8)

URL	Tag	Source
http://www.securityfocus.com/bid/97409	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://bugs.proftpd.org/show_bug.cgi?id=4295	2019-08-08
https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed	2019-08-08
https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f	2019-08-08
https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8	2019-08-08

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html	2019-08-08
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html	2019-08-08
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html	2019-08-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				<= 1.3.5 Search vendor "Proftpd" for product "Proftpd" and version " <= 1.3.5"		d		Affected
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				1.3.6 Search vendor "Proftpd" for product "Proftpd" and version "1.3.6"		-		Affected
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				1.3.6 Search vendor "Proftpd" for product "Proftpd" and version "1.3.6"		rc1		Affected
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				1.3.6 Search vendor "Proftpd" for product "Proftpd" and version "1.3.6"		rc2		Affected
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				1.3.6 Search vendor "Proftpd" for product "Proftpd" and version "1.3.6"		rc3		Affected
Proftpd Search vendor "Proftpd"		Proftpd Search vendor "Proftpd" for product "Proftpd"				1.3.6 Search vendor "Proftpd" for product "Proftpd" and version "1.3.6"		rc4		Affected