CVE-2016-5725

MEDIUM

JCraft JSch <0.1.54 - Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-5725. PoCs published by tintinweb.

AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in JSch (CVE-2016-5725) where a malicious SFTP server can force a client to write files outside the intended download directory. The PoC uses a modified SFTP server to serve a file with a traversal path, which the JSch client then downloads to an unintended location.

Description

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

Exploits (1)

exploitdb WORKING POC VERIFIED

by tintinweb · textdoswindows

https://www.exploit-db.com/exploits/40411

View Code ZIP pw:eip

This exploit demonstrates a path traversal vulnerability in JSch (CVE-2016-5725) where a malicious SFTP server can force a client to write files outside the intended download directory. The PoC uses a modified SFTP server to serve a file with a traversal path, which the JSch client then downloads to an unintended location.

Classification

Working Poc 100%

Attack Type

Other

Complexity

Moderate

Reliability

Reliable

Target: JSch 0.1.53 and earlier

Auth required

Prerequisites: Access to a vulnerable JSch client · Ability to set up a malicious SFTP server

MITRE ATT&CK