Remote command execution for Ruby Gem ftpd-0.2.1

#790 · 2013-02-18

CVE ID(s): CVE-2013-2512

Notified: 2013-02-18

Description:

ftpd is a pure Ruby FTP server library. It supports implicit and explicit TLS, passive and active mode, and most of the commands specified in RFC 969. It an be used as part of a test fixture or embedded in a program.

Exploit:

./ftpd-0.2.1/lib/ftpd/disk_file_system.rb

The problem code is below

204 Ls interface used by List and NameList 205
206 module Ls
207

208       def ls(ftp_path, option)
209         path = expand_ftp_path(ftp_path)
210         dirname = File.dirname(path)
211         filename = File.basename(path)
212         command = [
213           'ls',
214           option,
215           filename, <-- ;cmd inject
216           '2>&1',
217         ].compact.join(' ')
218         if File.exists?(dirname) <- file has to exist to exec ls command
219           list = Dir.chdir(dirname) do
220             `{command}` <-- exec?

Notes:

Download: http://rubygems.org/gems/ftpd

URL: http://www.vapid.dhs.org/advisories/ftp-0.2.1-remote-exec.html