Attack Chain

1. The attacker connects to the FTP server using anonymous credentials.
2. The attacker sends a "STOR" command to initiate a file upload.
3. The attacker sends a crafted payload with 247 bytes of padding.
4. The attacker includes a return address within the crafted payload to redirect execution flow.
5. The attacker injects shellcode into the payload to perform malicious actions.
6. The FTP server's STOR command handler processes the oversized payload without proper bounds checking.
7. The buffer overflow overwrites the return address on the stack.
8. Upon function return, execution jumps to the attacker-controlled shellcode, granting arbitrary code execution.

Impact

Successful exploitation of this buffer overflow vulnerability allows remote attackers to execute arbitrary code on the FreeFloat FTP server. This can lead to complete system compromise, potentially resulting in data theft, denial-of-service, or further malicious activity within the network. Given the nature of FTP servers as data repositories, the impact can be significant for organizations using affected versions. The CVSS v3.1 score of 9.8 reflects the critical severity of this vulnerability.

Recommendation

• Upgrade or discontinue use of FreeFloat FTP Server 1.0 immediately, as it is no longer supported and contains known vulnerabilities.
• Deploy the Sigma rule "Detect Suspicious FTP STOR Command Payload" to identify potentially malicious STOR requests (see the rules section).
• Monitor network traffic for unusually large payloads associated with FTP STOR commands.