High · published March 29, 2023
CVSS calls it high at 8.2. It sits in the 99.6th percentile for exploit probability.
🚨 An unauthenticated remote attacker can delete any file on your CompleteFTP server with zero authentication needed! 🔥 Think of it like a bad delivery driver who just skips the signature check and tosses every package they find into the back of their truck — no questions asked. This vulnerability allows attackers to remove files at will, just like that rogue driver clearing out your mailbox! This means an attacker could wipe out critical files, leading to service interruptions, data loss, and potentially crippling your operations. With SYSTEM-level access, they could even take down your entire server environment — that’s absolutely devastating!
Think of it like a bad delivery driver who just skips the signature check and tosses every package they find into the back of their truck — no questions asked. This vulnerability allows attackers to remove files at will, just like that rogue driver clearing out your mailbox! The vulnerability arises from improper validation in the HttpFile class, allowing attackers to execute file operations without any authentication, thus deleting files on the server directly.
This means an attacker could wipe out critical files, leading to service interruptions, data loss, and potentially crippling your operations. With SYSTEM-level access, they could even take down your entire server environment — that’s absolutely devastating! Upgrade to CompleteFTP version 22.1.1 or higher immediately to close this loophole. Additionally, review your file operation permissions to ensure that security measures are in place. Don't forget to monitor logs for any suspicious file deletions! You've got this! Take these steps, and your CompleteFTP server will be safe and sound. 🛡️