CVE-2019-7227

Related Files

ABB IDAL FTP Server Path Traversal

Posted Jun 21, 2019

Authored by Eldar Marcussen

The IDAL FTP server fails to ensure that directory change requests do not change to locations outside of the FTP servers root directory. An authenticated attacker can simply traverse outside the server root directory by changing the directory with "cd ..". An authenticated attacker can traverse to arbitrary directories on the hard disk and then use the FTP server functionality to download and upload files. An unauthenticated attacker can take advantage of the hardcoded or default credential pair exor/exor to become an authenticated attacker.

tags | exploit, arbitrary, root

advisories | CVE-2019-7227

SHA-256 | 00c2ac3a1ecb33776d1003c082f02f6355b49f02e6dd423c518718f20b434e76

Download | Favorite | View