  
| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Curveball 2020 Dual Audio Hindi Fan Dubbed 720p Camrip 💯 💯The request for a story about "Curveball 2020 Dual Audio Hindi Fan Dubbed 720p CAMRip" is a bit of a trick, isn't it? That specific string of text looks more like a classic for a German political satire film than a traditional story prompt. When he finally hit "Export," the file name was a mess of metadata: Curveball.2020.Dual.Audio.Hindi.FanDub.720p.CAMRip.x264 . Curveball 2020 Dual Audio Hindi Fan Dubbed 720p CAMRip His latest obsession was Curveball , a film about the true-story absurdities of the Iraq War's intelligence failures. He didn't have a studio or a master file. All he had was a —a shaky, grainy recording someone had managed to sneak out of a theater before the world locked down. You could occasionally see the silhouette of a spectator’s head or hear the crunch of popcorn in the background, but to Arjun, it was gold. The request for a story about "Curveball 2020 However, if we weave those "technical specs" into a narrative, we get a story about the lengths people go to for a piece of cinema. Here is a short story based on that vibe: The Ghost in the Machine His latest obsession was Curveball , a film For three weeks, Arjun lived in his headphones. He worked on the track, meticulously syncing his own Hindi Fan Dub over the original German dialogue. He voiced the lead bioweapons expert with a frantic, gravelly urgency, matching the actor's panicked eyes through the digital noise of the low-res rip. He uploaded it to a private forum at 3:00 AM. Within minutes, the comments flooded in from thousands of miles away. They didn't care about the grainy picture or the occasional muffled sneeze in the audio; they wanted the story. In a year where the truth felt stranger than fiction, Arjun’s "bootleg" was the only way they could see how a single lie—the original "Curveball"—had once changed the world. The year was 2020, and the world was quiet, but Arjun’s basement was buzzing. He was a "Ghost Dubber," an anonymous voice in the digital underground who gave Hollywood—and in this case, German—cinema a local tongue.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |