Asustor ADM FTP Backup Path Traversal Vulnerability Allowing Arbitrary File Overwrite

A path traversal vulnerability has been identified in the FTP Backup feature on Asustor's ADM operating system. This vulnerability affects versions 4.1.0 prior to 4.3.3.ROF1 and 5.0.0 prior to 5.1.2.RE51. The issue arises because the FTP Backup does not properly sanitize filenames received from the FTP server when parsing directory listings. As a result, a malicious server or a Man-in-the-Middle (MitM) attacker could craft filenames with path traversal sequences, leading the client to write files outside the designated backup directory. Exploiting this vulnerability could allow an attacker to overwrite arbitrary files on the system, potentially escalating privileges or executing remote code.

Impact

Successful exploitation allows overwriting of arbitrary files on the system, with potential for privilege escalation or remote code execution.

Remediation

Users can upgrade to Asustor ADM 5.1.2.REO1 or above. For versions 4.1, 4.2, and 4.3, the vulnerability is still ongoing.