CriticalPublic exploit

Stack-based Buffer Overflow in EasyFTP Server HTTP list.html Path Handling

IdentifiersCVE-2010-20113CWE-121· Stack-based Buffer Overflow

CVE-2010-20113 affects EasyFTP Server 1.7.0.11 and earlier. The vulnerability is a stack-based buffer overflow in the product's embedded HTTP interface when handling a GET request to list.html. Specifically, the server does not properly validate the length of the path parameter supplied in the request. An attacker can send an excessively long path value, causing a stack buffer overflow that may overwrite adjacent stack memory and corrupt control-flow data. According to the provided content, the vulnerable condition is reachable through the embedded web server and, because anonymous access is enabled by default, exploitation does not require authentication. The issue was fixed in version 1.7.0.12, after which the product was renamed to UplusFtp.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause memory corruption in the EasyFTP Server process, including corruption of stack-resident control-flow structures. In practical terms, this may allow an unauthenticated remote attacker to crash the service, trigger denial of service, and potentially achieve arbitrary code execution in the security context of the vulnerable server process, depending on exploitability conditions and target environment characteristics.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, disable or restrict access to the embedded HTTP interface, especially external network exposure to the vulnerable web service. Limit access to trusted administrative networks only, place the service behind firewall rules or reverse-proxy filtering, and disable anonymous access if operationally feasible. Network-based controls such as IPS/WAF signatures may help detect or block oversized GET requests targeting list.html with unusually long path parameters, but these should be treated only as temporary compensating controls until the software is upgraded.

Remediation

Patch, then assume compromise.

Upgrade EasyFTP Server to version 1.7.0.12 or later, which resolves the vulnerable path-parameter handling in the HTTP interface. Because the vendor renamed the product to UplusFtp after this fix, ensure any deployed successor versions are also updated to a non-vulnerable release. If legacy deployments remain, prioritize replacement or decommissioning of affected EasyFTP Server 1.7.0.11 and earlier instances.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

easyftp_list.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (modules/exploits/windows/http/easyftp_list.rb) that exploits a stack-based buffer overflow vulnerability in EasyFTP Server version 1.7.0.11 and earlier. The exploit targets the 'path' parameter in an HTTP GET request to /list.html, allowing an attacker to execute arbitrary code on the target Windows system. The module is operational and allows for customizable shellcode payloads, with a payload space of 256 bytes and specific bad characters filtered. The exploit does not require authentication due to the default anonymous access configuration of EasyFTP Server. The module includes a check method to fingerprint the target service and is designed for use within the Metasploit framework. The only fingerprintable endpoint is the /list.html HTTP path with the 'path' parameter. The repository is structured as a single Ruby file, following standard Metasploit module conventions.

Disclosed Feb 18, 2010rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Easyftp Server ProjectEasyftp Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2010-20113

NVD

nvd.nist.gov/vuln/detail/CVE-2010-20113

MITRE CWE · CWE-121

Stack-based Buffer Overflow

Third Party Advisory

raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb

Third Party Advisory

vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow

Exploit

exploit-db.com/exploits/11500

Stack-based Buffer Overflow in EasyFTP Server HTTP list.html Path Handling

IdentifiersCVE-2010-20113CWE-121· Stack-based Buffer Overflow