Loading vulnerability…
DLL Hijacking in FileZilla Client 3.63.1
FileZilla Client 3.63.1 for Windows is affected by a DLL search-order hijacking vulnerability. The client loads TextShaping.dll from its application directory when it starts. An attacker able to place a crafted DLL in that directory can cause FileZilla to load it and execute attacker-controlled code upon application launch.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in execution of malicious, arbitrary code in the context of the launched FileZilla Client process. A reverse-shell payload may be used to obtain remote command execution.
If you can’t patch tonight, do this now.
Restrict write access to FileZilla Client application directories and prevent untrusted users or processes from placing DLLs in those locations. Avoid installing software from untrusted sources.
Patch, then assume compromise.
Update FileZilla Client to a version that addresses the DLL hijacking issue. Protect application installation directories from unauthorized modification.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.