Skip to content

Commit 953a642

Browse files
committed
Finally write a decent description
1 parent e3ed790 commit 953a642

File tree

1 file changed

+10
-1
lines changed

1 file changed

+10
-1
lines changed

modules/auxiliary/server/tnftp_savefile.rb

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,16 @@ def initialize(info = {})
1414
super(update_info(info,
1515
'Name' => 'tnftp "savefile" Arbitrary Command Execution',
1616
'Description' => %q{
17-
This module exploits a vulnerability.
17+
This module exploits an arbitrary command execution vulnerability in
18+
tnftp's handling of the resolved output filename - called "savefile" in
19+
the source - from a requested resource.
20+
21+
If tnftp is executed without the -o command-line option, it will resolve
22+
the output filename from the last component of the requested resource.
23+
24+
If the output filename begins with a "|" character, tnftp will pass the
25+
fetched resource's output to the command directly following the "|"
26+
character through the use of the popen() function.
1827
},
1928
'Author' => [
2029
'Jared McNeill', # Vulnerability discovery

0 commit comments

Comments
 (0)