CVE-2019-19664
📋 TL;DR
This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in Rumpus FTP Web File Manager's web settings interface. Attackers can trick authenticated administrators into unknowingly submitting malicious requests that modify server web settings. This affects Rumpus FTP administrators who access the web interface while authenticated.
💻 Affected Systems
- Rumpus FTP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of web server settings, potentially enabling further attacks like redirecting users to malicious sites, disabling security features, or modifying authentication mechanisms.
Likely Case
Unauthorized changes to web server configuration, potentially disrupting service availability or enabling phishing attacks through modified web content.
If Mitigated
No impact if CSRF protections are implemented or if administrators don't access malicious sites while authenticated.
🎯 Exploit Status
Exploitation requires the victim administrator to be authenticated and visit a malicious webpage. CSRF attacks are well-understood and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.2.9.2 or later
Vendor Advisory: https://www.maxum.com/Rumpus/
Restart Required: Yes
Instructions:
1. Download latest version from Maxum website. 2. Backup current configuration. 3. Install update. 4. Restart Rumpus service. 5. Verify web settings functionality.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to web settings forms
Requires custom web application modifications
Network Segmentation
allRestrict access to Rumpus web interface to trusted networks only
firewall rules to limit access to specific IPs
🧯 If You Can't Patch
- Implement strict SameSite cookie policies for Rumpus web sessions
- Use separate browser profiles for administrative tasks and general web browsing
🔍 How to Verify
Check if Vulnerable:
Check if Rumpus version is 8.2.9.1 or earlier and examine WebSettingsGeneralSet.html for CSRF protectionsCheck Version:
Check Rumpus admin interface or installation directory for version informationVerify Fix Applied:
Verify version is 8.2.9.2 or later and test CSRF protection by attempting to submit form without proper tokens📡 Detection & Monitoring
Log Indicators:
- Multiple web settings changes from same session in short time
- Settings modifications without corresponding admin login events
Network Indicators:
- HTTP POST requests to RAPR/WebSettingsGeneralSet.html without Referer headers or with external origins
SIEM Query:
source="rumpus.log" AND (event="settings_change" OR url="/RAPR/WebSettingsGeneralSet.html") | stats count by src_ip, user