CVE-2023-45198
📋 TL;DR
This vulnerability in ftpd allows unauthenticated attackers to obtain information about the host filesystem before authentication using MLSD or MLST commands. It affects NetBSD-ftpd before 20230930 and tnftpd before 20231001. The information leak could reveal directory structures and file metadata.
💻 Affected Systems
- NetBSD-ftpd
- tnftpd (portable NetBSD ftpd)
📦 What is this software?
Ftpd by Netbsd
Tnftpd by Netbsd
⚠️ Risk & Real-World Impact
Worst Case
Attackers map the entire filesystem structure, identify sensitive directories, and use this reconnaissance for subsequent attacks like privilege escalation or data exfiltration.
Likely Case
Attackers discover directory layouts, user home directories, configuration file locations, and other system information that aids in targeted attacks.
If Mitigated
Limited exposure of non-sensitive directory structures with no authentication bypass or data access.
🎯 Exploit Status
Exploitation requires only sending standard FTP commands (MLSD/MLST) before authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NetBSD-ftpd 20230930, tnftpd 20231001
Vendor Advisory: https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html
Restart Required: Yes
Instructions:
1. Update NetBSD system to include ftpd fixes after 20230930. 2. For tnftpd, upgrade to version 20231001 or later. 3. Restart ftpd service.
🔧 Temporary Workarounds
Disable MLSD/MLST commands
allConfigure ftpd to reject MLSD and MLST commands before authentication
Check ftpd configuration for command restrictions
Use firewall rules
linuxRestrict FTP access to trusted networks only
iptables -A INPUT -p tcp --dport 21 -s TRUSTED_NET -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate FTP servers
- Monitor FTP logs for MLSD/MLST commands from unauthenticated users
🔍 How to Verify
Check if Vulnerable:
Connect to FTP server anonymously and issue MLSD or MLST command before authenticationCheck Version:
ftpd -v or check package version: pkg_info | grep ftpdVerify Fix Applied:
After patching, attempt MLSD/MLST before authentication should be rejected📡 Detection & Monitoring
Log Indicators:
- MLSD or MLST commands from unauthenticated users
- FTP session without successful USER/PASS commands
Network Indicators:
- FTP traffic with MLSD/MLST commands before authentication packets
SIEM Query:
source="ftp.log" AND (command="MLSD" OR command="MLST") AND NOT auth_success="true"🔗 References
- http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
- https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html
- http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95
- https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html
