Executive brief
A vulnerability in certain FTP servers allows remote users to discover the internal file path of the 'ftp' user's home directory. This information disclosure can help an attacker map the server's internal file system, potentially aiding in more complex subsequent attacks. While it does not directly grant access to sensitive files, it reveals configuration details that should remain private.
Technical details
The vulnerability involves an information disclosure flaw in the implementation of the FTP 'CWD' (Change Working Directory) command when preceded by the 'QUOTE' command. By sending a 'QUOTE CWD' request, an unauthenticated remote attacker can force the server to return the absolute physical path of the anonymous or 'ftp' user's home directory in its response. This bypasses intended directory masking or chroot restrictions that usually hide the underlying system path from the user. This reconnaissance data can be used to identify the operating system structure or locate other sensitive directories on the host.
Affected products
- Unknown FTP Server
Timeline
- 1997-01-01: disclosed