CVE-2014-1841

Nuclei

Titan FTP Server 10.32 Build 1816 - Directory Traversal

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2014-1841 has a selected CVSS score of 5.0; EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Directory traversal vulnerability in the web interface in Titan FTP Server before 10.40 build 1829 allows remote attackers to copy an arbitrary user's home folder via a Move action with a .. (dot dot) in the src parameter.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBTitan FTP Server 10.32 Build 1816 - Directory TraversalExploitDB exploitby Fara RusteinNot analyzed1 file

linked to 3 vulnerabilities

ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMTitan FTP Server < 10.40 Move Function - Directory TraversalCVSS 5

Titan FTP Server versions prior to 10.40 build 1829 contain a directory traversal vulnerability in the Move function. Remote attackers can copy the complete home folder of another user by exploiting the ../ path traversal in the search-bar value, allowing unauthorized access to sensitive user data.

Impact

Unauthenticated attackers can exploit directory traversal in the Move function to copy complete home folders of other users, allowing unauthorized access to sensitive user data stored on the FTP server.

Remediation

Update Titan FTP Server to version 10.40 build 1829 or later that properly validates path parameters in the Move function to prevent directory traversal.

WeaknessesCWE-22
Authorspussycat0x
Template tagscvecve2014networkftptitan-ftptcppassivelfivuln
CVSS vector: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CPE: cpe:2.3:a:southrivertech:titan_ftp_server:*:*:*:*:*:*:*:*
Shodan: product:"Titan ftpd"
http://www.exploit-db.com/exploits/31579

Source: ProjectDiscovery

References

5