CVE-2010-20113
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on EasyFTP Server by exploiting a stack-based buffer overflow in the HTTP interface. Attackers can send specially crafted GET requests to list.html with an overly long path parameter, potentially gaining full system control. Organizations running EasyFTP Server 1.7.0.11 or earlier with the web interface exposed are affected.
💻 Affected Systems
- EasyFTP Server
📦 What is this software?
Easyftp Server by Easyftp Server Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, ransomware deployment, or creation of persistent backdoors.
Likely Case
Remote code execution with SYSTEM/Administrator privileges, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
If Mitigated
Denial of service or crash if exploit fails, but proper controls should prevent exploitation entirely.
🎯 Exploit Status
Metasploit module available, exploit requires minimal technical skill, works reliably against vulnerable versions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0.12 (renamed to UplusFtp)
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Download UplusFtp (successor product) from official vendor. 2. Uninstall EasyFTP Server completely. 3. Install UplusFtp. 4. Restart system. 5. Verify web interface is disabled or properly secured.
🔧 Temporary Workarounds
Disable HTTP Interface
windowsCompletely disable the embedded web server component to remove attack surface.
Navigate to EasyFTP Server configuration, find HTTP/Web Server settings, disable all web services.
Network Segmentation
allBlock external access to EasyFTP Server HTTP port (default 80/8080) at firewall.
Firewall rule: Block TCP ports 80, 8080 to EasyFTP Server IP from external networks.
🧯 If You Can't Patch
- Immediately disable the HTTP interface in server configuration
- Implement strict network segmentation and firewall rules to block all external access to the server
🔍 How to Verify
Check if Vulnerable:
Check EasyFTP Server version in About dialog or program files. Versions 1.7.0.11 or earlier are vulnerable.Check Version:
Check program files for version.txt or examine About dialog in GUI.Verify Fix Applied:
Verify installation of UplusFtp or version 1.7.0.12+, test that HTTP interface no longer accepts malicious requests.📡 Detection & Monitoring
Log Indicators:
- Unusually long GET requests to list.html
- Multiple failed requests with long path parameters
- Server crash/restart events
Network Indicators:
- HTTP requests with path parameters exceeding normal length (>200 chars) to list.html
- Traffic patterns matching Metasploit exploit signatures
SIEM Query:
source="easyftp" AND (url="*list.html*" AND url_length>200) OR (event="crash" AND process="easyftp")🔗 References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb
- https://www.exploit-db.com/exploits/11500
- https://www.vulncheck.com/advisories/easyftp-server-list-html-stack-buffer-overflow
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/easyftp_list.rb
- https://www.exploit-db.com/exploits/11500
