FTP Access Control Check

漏洞信息

漏洞名称： FTP Access Control Check

漏洞类型： 未授权访问

漏洞等级： 中危

漏洞描述： 该漏洞涉及Microsoft IIS FTP服务的访问控制配置问题。IIS（Internet Information Services）是微软提供的一款广泛使用的Web服务器软件，其FTP服务功能允许用户通过网络进行文件传输，常见于企业内部文件共享和网站内容管理场景。由于配置不当，未对FTP服务设置IP地址限制，导致未经授权的网络可以访问FTP服务，增加了数据泄露和其他安全威胁的风险。漏洞的技术根源在于FTP服务的IP安全配置中，’allowUnlisted’属性被设置为true，这意味着未列出的IP地址被允许访问FTP服务，缺乏必要的访问控制。这种配置问题可能导致攻击者无需认证即可访问敏感文件，甚至上传恶意文件，进一步危害服务器安全。由于该漏洞可能被远程利用，且不需要用户交互，因此对企业的信息安全构成中等程度的威胁。

产品厂商： Microsoft

产品名称： IIS FTP Service

来源： https://github.com/projectdiscovery/nuclei-templates/blob/b740ee6791c0a6d36cac233d23a096ba91d2f060/code%2Fwindows%2Faudit%2Fkisa%2Fftp-access-control-check.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: ftp-access-control-check

info:
  name: FTP Access Control Check
  author: nukunga[SungHyunJeon]
  severity: medium
  description: |
    Ensure FTP access is restricted by configuring IP address filters. Without these restrictions, unauthorized networks could potentially access FTP services.
  impact: |
    Lack of proper IP-based access control allows FTP services to be accessed by unauthorized networks, heightening the risk of data breaches and other security threats.
  remediation: |
    Set up IP address restrictions using IIS Manager:
    - Open IIS Manager.
    - Go to the FTP site → FTP IP Address and Domain Restrictions.
    - Add the allowed IP addresses and configure suitable deny rules.
  reference:
    - https://isms.kisa.or.kr/main/csap/notice/?boardId=bbs_0000000000000004&mode=view&cntId=85
  tags: ftp,iis,security,windows,code,windows-audit,kisa

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      Import-Module WebAdministration -ErrorAction SilentlyContinue
      $ftpSites = Get-ChildItem IIS:\Sites | Where-Object { $_.Bindings.Collection.Protocol -eq "ftp" }
      $vulnerable = $false
      foreach ($site in $ftpSites) {
          $ipSecurity = Get-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$($site.Name)" -filter "system.ftpServer/security/ipSecurity" -name "allowUnlisted" -ErrorAction SilentlyContinue
          # If allowUnlisted is true, FTP access is open to unlisted IPs (i.e., no proper IP restriction is applied)
          if ($ipSecurity -eq $true) {
              $vulnerable = $true
              break
          }
      }
      if ($vulnerable) {
          "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"
      } else {
          "FTP_IP_ACCESS_CONTROL_CONFIGURED"
      }

    matchers:
      - type: word
        words:
          - "FTP_IP_ACCESS_CONTROL_NOT_CONFIGURED"