| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Secret-neighbor-pc-game-free-download-full-version -: Matches typically require at least 4 players , though the official FAQ recommends 6 for the best experience. System Requirements for PC Secret Neighbor is a multiplayer social horror game set in the Hello Neighbor universe. A group of kids tries to break into their creepy neighbor’s basement to rescue their missing friend, but there is a catch: one of the kids is actually the . Gameplay Features secret-neighbor-pc-game-free-download-full-version Searching for a of Secret Neighbor often leads to unofficial download sites that may carry security risks. While several third-party platforms offer pre-installed versions, the most secure and reliable way to play is through official stores like Steam or the Epic Games Store, where it is frequently available at a discount or through special promotions. Game Overview : Matches typically require at least 4 players : The Neighbor’s goal is to gain the trust of the other players, use gadgets like bear traps or smoke grenades, and pick them off one by one without being caught. Gameplay Features Searching for a of Secret Neighbor : Sites like Softonic or Malavida host download links, but these may not always be the most up-to-date "full version" compared to official launchers.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |