2 replies to this topic

[mebob]

I don't know if it's specific to my server, FileZilla, but I found something that could be a HUGE security flaw: you can be connected to the passive mode port from a totally different IP. And, when the RETR command is issued to retrieve a file, the file simply gets transferred to the other computer attached to the port. I was simply messing around with Ncat from the Nmap project when I came upon this thought. So I got my friend (whom I was chatting with) to run it and connect, and what do you know, it simply transferred all the data there. Is this already known, and is it really much to worry about?

[Alexander]

It is hard to understand exactly what you are describing.

When you enter the RETR command on a file, it somehow transfers to whatever local folder they have open? The other way around?

It appears that you are saying their RETR command retrieves a file to their system, which is to be expected.

[mebob]

This is what I meant originally:

Let's say there are three computers involved: a client, a server, and a malicious user. The client connects to port 21 for FTP on the server. When the client issues the PASV command, the malicious user connects to one of the passive ports on the server (the only problem is determining which port). When the client issues the RETR command, because the malicious user is connected to the data port instead of the regular client, the malicious user receives the file.

I now see why this isn't really an issue, because unless a client is very poorly designed, it wouldn't issue the RETR command without being able to connect to the data port :D Sorry, I was kinda tired when I asked the question.