CVE-2023-38960
📋 TL;DR
This vulnerability allows a local attacker to escalate privileges and execute arbitrary code on systems running RaidenFTPD v2.4 build 4005 due to insecure file permissions in the installation directory. Attackers can place malicious executables that run with elevated privileges when the service executes.
💻 Affected Systems
- Raiden Professional Server RaidenFTPD
📦 What is this software?
Raidenftpd by Raidenftpd
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, allowing installation of persistent backdoors, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, service disruption, and potential foothold for further attacks.
If Mitigated
Limited impact with proper access controls, but still presents risk if attackers gain initial access to the system.
🎯 Exploit Status
Exploitation requires local access to place malicious executables in the installation directory. The vulnerability is well-documented with public technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: Yes
Instructions:
1. Check if newer versions exist from vendor
2. If no patch available, apply workarounds
3. Consider migrating to alternative FTP server software
🔧 Temporary Workarounds
Restrict Installation Directory Permissions
windowsSet strict file permissions on the RaidenFTPD installation directory to prevent unauthorized write access
icacls "C:\Program Files\RaidenFTPD" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Users:(OI)(CI)RX"
Run Service with Least Privilege
windowsConfigure RaidenFTPD service to run with minimal required privileges instead of elevated permissions
sc config RaidenFTPD obj= "NT AUTHORITY\LocalService" password= ""
🧯 If You Can't Patch
- Remove write permissions for non-administrative users from the RaidenFTPD installation directory
- Monitor the installation directory for unauthorized file creation or modification attempts
🔍 How to Verify
Check if Vulnerable:
Check RaidenFTPD version via Help → About in the application interface or examine the executable propertiesCheck Version:
Check executable properties or registry at HKEY_LOCAL_MACHINE\SOFTWARE\RaidenFTPDVerify Fix Applied:
Verify installation directory permissions using 'icacls "C:\Program Files\RaidenFTPD"' and ensure only administrators have write access📡 Detection & Monitoring
Log Indicators:
- Unexpected file creation in RaidenFTPD directory
- Service restart events
- Privilege escalation attempts
Network Indicators:
- Unusual FTP traffic patterns
- Unexpected outbound connections from FTP service
SIEM Query:
EventID=4663 AND ObjectName LIKE '%RaidenFTPD%' AND Accesses LIKE '%WRITE%'