Ipswitch WS_FTP Server Privilege Escalation via SITE SETS Command

Vulnerability Key Information Advisory Name: Open the WS_FTP Server backdoor to SYSTEM Impact: Privilege escalation Discovered by: Hugh Mann Tested progs: Ipswitch WS_FTP Server 4.0.2.EVAL Description Vulnerability Type: Any local or remote user (including FTP system administrators) can execute programs on the FTP server with SYSTEM privileges. Severity: Regular users can exploit this vulnerability to escalate privileges, leading to significant security risks. Details Root Cause: Ipswitch failed to properly mask bits when processing the new SITE SETS command, allowing remote FTP system administrators to enable options that should only be controllable by local administrators. Secondary Vulnerability Explanation: "Remote" FTP system administrators (including local users) can execute programs on the FTP server under any user context, or if the user is local, they can log in as an FTP system administrator via a backdoor. Exploit Attack Method: Exploit via telnet/ftp login as an FTP system administrator or by using the backdoor. Enable remote editing of SITE commands/events (e.g., executing files). This feature is disabled by default but can be enabled by remote FTP administrators. Command Examples: Examples of using SITE LIST Site Options and SITE SETS commands. Backdoor Management Backdoor Administrator: Local Session Manager, with provided username and password. This information outlines a critical security vulnerability in WS_FTP Server involving privilege escalation and potential backdoor exploitation, providing technical details that are valuable for security and system administrators in developing awareness and response strategies.

Goal Reached Thanks to every supporter — we hit 100%!

Ipswitch WS_FTP Server Privilege Escalation via SITE SETS Command