[NET-670] Apache Commons Net ftpClient.java changeWorkingDirectory() Function CRLF Injection Remote Command Execution

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Not A Bug
• Affects Version/s: 3.6
• Component/s: FTP
• Labels: patch
• Flags: Patch, Important
• External issue ID: BlackDuck Hub VulnDB 171100
• Assignee: Unassigned
• Reporter: David Hurst
• Created: 15/May/19 20:11
• Updated: 06/Aug/20 12:25
• Resolved: 16/Jun/19 23:02

Description

Per BlackDuck Hub VulnDB 171100

Apache Commons Net contains a flaw in the changeWorkingDirectory() function in ftpClient.java that is triggered as user-supplied input is not properly sanitized. This may allow a remote attacker to use a newline character in a specially crafted string to execute arbitrary commands.