Project

General

Profile

Actions
Copy link

Bug #17060

closed
JP JP

Path traversal when downloading or deleting files via ``tftp_files.php``

Bug #17060: Path traversal when downloading or deleting files via ``tftp_files.php``

Added by Jim Pingle 10 days ago. Updated 7 days ago.

Status:
Resolved
Priority:
High
Assignee:
Jim Pingle
Category:
TFTP
Target version:
-
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

The TFTP package has a Files tab at tftp_files.php that allows administrators to manage files available to TFTP clients. Among other features, this page allows administrators to download or delete files by passing a path and filename.

The package contains an incomplete boundary check that fails to properly restrict the download and delete actions to the TFTP server file directory at /tftpboot. As a consequence, users with access to this page can use directory traversal techniques to download or delete arbitrary files on the device.

Reported by: Rafael Honorato (@honorato0)

Actions
Copy link

Also available in: Atom