| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Intitle Index.of Mp4 Fast And Furious 9 <90% ORIGINAL>Or search for of Creative Commons-licensed action films on sites like Videvo or Mixkit . Final Verdict “intitle:index.of mp4 Fast and Furious 9” is a digital ghost hunt. Even if you find a file, it’s probably fake, infected, or unwatchable. The movie is too big and too recent for unprotected servers to stay online for long. Renting F9 in HD usually costs – about the price of a coffee. Buying it digitally is around $9.99 – $14.99 . A Better “Google Dork” for Movie Lovers If you enjoy discovering hidden gems online, use legitimate search tricks instead. Try: Intitle Index.of Mp4 Fast And Furious 9 More importantly, the security risk is real. Open directories are unmoderated – anyone can upload anything. Cybercriminals know people search for “index.of” movie files, so they seed those directories with malicious payloads. The good news? F9 is widely available on legitimate streaming platforms. You don’t need to risk your device’s security or a legal headache. Or search for of Creative Commons-licensed action films | Platform | Requires Subscription? | Notes | |----------|----------------------|-------| | | Yes (Premium plan) | Home of Universal Pictures; often includes extended cuts. | | Amazon Prime Video | Rent or Buy | Available in 4K UHD. | | Apple TV (iTunes) | Rent or Buy | Often has bonus features. | | YouTube Movies | Rent or Buy | Convenient if you already use YouTube. | | Vudu / Fandango | Rent or Buy | Frequent sales on older titles. | | HBO Max | Yes | Sometimes rotates in Universal films; check current library. | The movie is too big and too recent
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |