Most ftp filesystem commands are dangerously affected by path traversal in
case the filesystem path passed as command argument is a symbolic link
pointing to a path outside the user's home directory.
Let's imagine the following scenario:
1. On a Unix system we got a user "foo" which has "/home/foo" as its home
directory.
2. We create a symbolic link pointing to a path outside its home directory,
e.g.:
foo@uds:/home/foo$ pwd
/home/foo
foo@uds:/home/foo$ ln -s /tmp/baz link
foo@uds:/home/foo$ ls -l link
drwxrwxrwx 1 foo user 1 2007-11-04 10:31 link -> /tmp/baz
3. We run pyftpdlib by creating a username called "foo" having "/home/foo"
as home directory, then we use an ftp client for connecting to the ftp server.
4. If /tmp/baz is a directory we can change the current directory by
issuing the "CWD link" command. If we then issue a LIST command the files
of /tmp/baz directory will be shown since we just joined it.
5. If /tmp/baz is a file we can get access to it by using different
commands like DELE (delete) and others.
Same problem affects commands like STOR and RETR, allowing an attacker to
retrieve or upload arbitrary system files.
This would be only limited by rights under which the server is running.
Although different Unix ftp servers permit it, in my opinion we should
forbid access to those parts of filesystem which are outside the user's
home directory since we can't consider the *real* user's permissions.
In order to solve the problem, we should check the type of every filesystem
path issued by client and reject the request in case such path is a
symbolic link.
From billiej...@gmail.com on November 26, 2007 21:58:50
Original issue: http://code.google.com/p/pyftpdlib/issues/detail?id=55