Local Access Vulnerability in ProFTPD FTP Server by ProFTPD Project

CVE-2017-7418

What is CVE-2017-7418?

The ProFTPD FTP server versions prior to 1.3.5e and 1.3.6 before 1.3.6rc5 contain a vulnerability allowing local users to exploit the configuration option AllowChrootSymlinks. This vulnerability arises because ProFTPD only verifies the last component of a given path when enforcing this option. A malicious actor with limited access can circumvent these restrictions by substituting intermediate path elements with symbolic links, leading to unauthorized access within the filesystem. Attackers may leverage this flaw to gain inappropriate access to files and directories, potentially compromising sensitive data.

References