RaidenFTPD contains a flaw that allows a remote attacker to access arbitrary files outside of the FTP root. The issue is due to the 'urlget' site command not properly sanitizing user input, specifically traversal style attacks (..\\) resulting in a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality
Exploit:
Exploit Public
Disclosure:
Vendor Verified
Solution
Upgrade to version 2.4 build 2241 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
ahoo.com -
