CVE-2009-5012: Improper Access Control in pyftpdlib
Summary
CVE-2009-5012: Improper Access Control in pyftpdlib. Affects pyftpdlib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- python-pyftpdlib · Debian:11
The same CVE-2009-5012 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. However, versions of pyftpdlib before 0.5.2 are vulnerable to an improper access control issue. This vulnerability allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
Vulnerability Detail
The vulnerability in pyftpdlib arises from the fact that the MLST command does not require the l permission. This oversight enables authenticated users to bypass access restrictions and view the root directory. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive files and directories on the FTP server.
How To Fix
Minimum fixed version
0.5.2
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of pyftpdlib is not immediately feasible, a temporary workaround is to disable the MLST command. This can be achieved by modifying the FTP server configuration to remove or restrict access to the MLST command. Here's an example of how to disable MLST in pyftpdlib:
from pyftpdlib import ftpserver
class CustomFTPHandler(ftpserver.FTPHandler):
def ftp_MLST(self, path):
self.respond('550 MLST command is disabled.')
# Create and start the FTP server
server = ftpserver.FTPServer(('0.0.0.0', 21), CustomFTPHandler)
server.serve_forever()
Conclusion
In conclusion, pyftpdlib versions prior to 0.5.2 are vulnerable to an improper access control issue that allows authenticated users to bypass access restrictions and view the root directory. It is crucial for users of pyftpdlib to upgrade to version 0.5.2 or later to mitigate the risk of unauthorized access. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
The vulnerability allows authenticated users to bypass access restrictions and view the root directory of the FTP server. This could potentially expose sensitive files and directories to unauthorized individuals.
Users of pyftpdlib versions prior to 0.5.2 are affected by this vulnerability. It is recommended for all users of pyftpdlib to upgrade to the latest version to mitigate the risk.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is important to promptly apply the recommended fixes to prevent potential unauthorized access.
As this vulnerability was reported prior to the introduction of the CVSS scoring system, there is no official CVSS score available for this specific vulnerability.
For more information about this vulnerability, you can refer to the CVE-2009-5012 entry or the GitHub Security Advisory GHSA-h4g7-8m7r-87r9.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
