********************************************************************** Discovered By: Kevin Randall on 3/23/2019 ********************************************************************** A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory. *********************************************************************** Tools used: Parrot OS Windows 7 32 Bit BurpSuite Browser ************************************************************************* Vulnerability has been fixed in the following build: Build: Titan FTP Server 2019 Build 3515 ************************************************************************** Proof of Concept (PoC): Step 1: Authenticate through Titan FTP Web GUI Step 2: Upload file and attempt to view it Step 3: Intercept requests with BurpSuite when attempting to view uploaded file Step 4: Modify "path=" and "filename=" parameters in the following GET request: Ex: View contents of README.txt file in Python27 directory: Note: You can access other files in directories such as System32, Desktop etc. Payload: ***************************************************************************************** GET /PreviewHandler.ashx?path=\..\..\..\..\Python27\README.txt&filename=README.txt ***************************************************************************************** Step 5: If path is set-up correctly and if file exists, you will receive a 200 OK back from the server. Step 6: View the file through the file preview in the FTP server. ************************************************************************************************** ************************************************************************************************** Timeline: Date Discovered: 3/23/2019 Date Disclosed to Vendor: 3/23/2019 CVE Obtained: 3/24/2019 Vendor Created Patched Version Titan FTP Version 2019 Build 3515: 3/25/2019 Vendor Created Entry in Jira System for issue (SVR-499): 3/25/2019 Date Disclosed: 3/26/2019 **************************************************************************************************