CVE-2018-10916

Vulnerability

LFTP versions up to and including 4.8.3 do not properly sanitize remote file names when performing reverse mirroring operations. The vulnerability exists in the mirror job code, where file names returned by an FTP server are used directly in rm and chmod commands, allowing a remote attacker to inject special file names (e.g., foobar/file:) that resolve to the current working directory [1][2][4]. The issue is triggered when a user runs lftp mirror --reverse --delete against an attacker-controlled FTP server, and the server returns a file name containing components such as file: that cause the local path to resolve to . (the current directory). The vulnerability is present in lftp before version 4.8.4 [1][3].

Exploitation

An attacker must operate a malicious FTP server that responds to directory listing requests with crafted file names (e.g., foobar/file:). The victim must connect to this server using lftp and execute a reverse mirror command with the --delete option, for example: lftp -c 'open -u user,pass attacker.com; mirror --reverse --delete /local/path /'. The attacker does not need any authentication on the victim's system, only the ability to lure the victim into running the reverse mirror command against the controlled server. The malicious file name triggers the deletion of the local current working directory, as demonstrated by the issue report [3].

Impact

Successful exploitation results in the removal of all files in the victim's current working directory (CWD) at the time the reverse mirror command is executed. This can lead to significant data loss if the victim operates in a critical directory (e.g., / when run as root). The CIA impact is primarily a loss of integrity (destruction of files) and availability (removal of accessible data). There is no disclosure of information or remote code execution; the attacker only achieves unauthorized file deletion within the scope of the victim's privileges and the current working directory [3][4].

Mitigation

The vulnerability is fixed in lftp version 4.8.4, as per the upstream commit that prepends ./ to filenames passed to rm and chmod commands, preventing URL-style path resolution [2]. Ubuntu released an update (USN-3731-2) for Ubuntu 12.04 ESM to address this issue [1]. Users are strongly advised to update lftp to version 4.8.4 or later. If upgrading is not immediately possible, users should avoid running lftp reverse mirror commands (mirror --reverse --delete) against untrusted FTP servers. The vulnerability is not known to be listed in CISA's KEV catalog.