[+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-V7-CSRF.txt
Cross site request forgery (CSRF)
Multiple CSRF vectors exists within FTGate v7 allowing the following attacks
1) add arbitrary domains
2) enable arbitrary remote archiving of logs
3) whitelist arbitrary email addresses
4) add arbitrary mailbox & disable antivirus,
5) remove email attachment blocking for filez.
1) add arbitrary remote domain:
2) enable arbitrary remote archive:
disable Antivirus for .exe files: also, has a persistent XSS inject but our payload gets truncated at 5 chars,
but can corrupt the loading of valid XML returned from database to the WEB UI.
HTTP response after attack outputs corrupted XML generating errors.
add arbitrary Admins:
whitelist arbitrary email addresses:
Messages that originate from these email addresses are not filtered by the Word or Phrase filters.
when access the above URL it returns XML with all file extensions blocked on incoming email, we now know ID in database.
so to remove blocking of .cmd we select '11'
or remove blocking of multiple file types in one shot
add arbitrary mailbox:
Vendor Notification: September 29, 2015
October 1, 2015 : Public Disclosure
Request Method(s): [+] GET
Vulnerable Product: [+] FTGate v7
Vulnerable Parameter(s): [+] type, id, mode, add, extarcserver
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.