{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/freefloat-ftp-server/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeFloat FTP Server"],"_cs_severities":["critical"],"_cs_tags":["cve-2019-25614","buffer-overflow","ftp","stor","code-execution","windows"],"_cs_type":"advisory","_cs_vendors":["FreeFloat"],"content_html":"\u003cp\u003eFreeFloat FTP Server version 1.0 is susceptible to a buffer overflow vulnerability (CVE-2019-25614) within the handling of the STOR command. This flaw allows unauthenticated remote attackers to execute arbitrary code on the affected system. The attack involves sending a specially crafted STOR request to the FTP server, exploiting a lack of proper bounds checking when processing the incoming data. Successful exploitation grants the attacker complete control over the compromised server, potentially leading to data exfiltration, system disruption, or further lateral movement within the network. This vulnerability poses a significant risk to organizations utilizing the outdated and unsupported FreeFloat FTP Server 1.0 software.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker connects to the FTP server using anonymous credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a \u0026quot;STOR\u0026quot; command to initiate a file upload.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted payload with 247 bytes of padding.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a return address within the crafted payload to redirect execution flow.\u003c/li\u003e\n\u003cli\u003eThe attacker injects shellcode into the payload to perform malicious actions.\u003c/li\u003e\n\u003cli\u003eThe FTP server's STOR command handler processes the oversized payload without proper bounds checking.\u003c/li\u003e\n\u003cli\u003eThe buffer overflow overwrites the return address on the stack.\u003c/li\u003e\n\u003cli\u003eUpon function return, execution jumps to the attacker-controlled shellcode, granting arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this buffer overflow vulnerability allows remote attackers to execute arbitrary code on the FreeFloat FTP server. This can lead to complete system compromise, potentially resulting in data theft, denial-of-service, or further malicious activity within the network. Given the nature of FTP servers as data repositories, the impact can be significant for organizations using affected versions. The CVSS v3.1 score of 9.8 reflects the critical severity of this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade or discontinue use of FreeFloat FTP Server 1.0 immediately, as it is no longer supported and contains known vulnerabilities.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Suspicious FTP STOR Command Payload\u0026quot; to identify potentially malicious STOR requests (see the \u003ccode\u003erules\u003c/code\u003e section).\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unusually large payloads associated with FTP STOR commands.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-freefloat-ftp-overflow/","summary":"FreeFloat FTP Server 1.0 is vulnerable to a buffer overflow in the STOR command handler, enabling remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload.","title":"FreeFloat FTP Server 1.0 STOR Command Buffer Overflow","url":"https://feed.craftedsignal.io/briefs/2024-01-freefloat-ftp-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeFloat FTP Server","version":"https://jsonfeed.org/version/1.1"}