[原文]Directory traversal vulnerability in Transsoft FTP Broker before 5.5 allows attackers to (1) delete arbitrary files via DELETE, or (2) list arbitrary directories via LIST, via a .. (dot dot) in the file name.
Broker FTP LIST Command Traversarl Arbitrary Directory Listing
Remote / Network Access
Loss of Confidentiality
Broker FTP server contains a flaw that allows a remote attacker to list and retrieve files outside of the FTP root directory. The issue is due to the server not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the 'LIST' or 'DIR' FTP commands.
Currently, there are no known upgrades or patches to correct this issue. It may be possible to correct the flaw by implementing the following workaround: Use file system permissions to restrict access of the FTP service and FTP users.