CVE-2020-9470
HIGHWing FTP Server < 6.2.5 - Session Cookie Exposure via Insecure Directory Permissions
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-9470. PoCs published by Al1ex.
AI-analyzed exploit summary This repository contains a functional privilege escalation exploit for Wing FTP Server 6.2.5 (CVE-2020-9470). The exploit steals an admin session, modifies it to bypass IP restrictions, and uses the admin's session to execute Lua commands that set a SUID bit on a backdoor binary, leading to root access.
Description
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
Exploits (1)
This repository contains a functional privilege escalation exploit for Wing FTP Server 6.2.5 (CVE-2020-9470). The exploit steals an admin session, modifies it to bypass IP restrictions, and uses the admin's session to execute Lua commands that set a SUID bit on a backdoor binary, leading to root access.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H