CVE-2019-9760
📋 TL;DR
CVE-2019-9760 is a critical remote code execution vulnerability in FTPGetter Standard FTP client software. When users connect to a malicious FTP server, crafted responses can trigger memory corruption leading to arbitrary code execution or client crashes. This affects all users of FTPGetter Standard version 5.97.0.177 who connect to untrusted FTP servers.
💻 Affected Systems
- FTPGetter Standard
📦 What is this software?
Ftpgetter by Ftpgetter
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, steal credentials, or use the compromised system as a foothold for further attacks.
If Mitigated
Denial of service through client crashes if memory corruption doesn't lead to successful code execution.
🎯 Exploit Status
Multiple public exploit scripts are available, including Python scripts that demonstrate both RCE and crash capabilities. Exploitation requires user interaction to initiate FTP connection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 5.97.0.177
Vendor Advisory: Not publicly documented in vendor advisory format
Restart Required: Yes
Instructions:
1. Open FTPGetter Standard. 2. Navigate to Help > Check for Updates. 3. Install the latest available update. 4. Restart the application. 5. Verify version is no longer 5.97.0.177.
🔧 Temporary Workarounds
Network Segmentation
allBlock outbound FTP connections to untrusted networks and restrict FTP usage to approved internal servers only.
Application Control
windowsDisable or uninstall FTPGetter Standard until patched, and use alternative FTP clients that are not vulnerable.
🧯 If You Can't Patch
- Implement strict outbound firewall rules to block FTP connections (TCP port 21) to all but approved, trusted FTP servers.
- Educate users to never connect to unknown or untrusted FTP servers and consider using SFTP/FTPS alternatives instead of plain FTP.
🔍 How to Verify
Check if Vulnerable:
Check FTPGetter Standard version by opening the application and navigating to Help > About. If version is exactly 5.97.0.177, the system is vulnerable.Check Version:
Not applicable via command line - must check through application GUIVerify Fix Applied:
After updating, verify the version is no longer 5.97.0.177. Test connecting to a known safe FTP server to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Multiple failed FTP connection attempts followed by successful connection to suspicious IPs
- Application crash logs from FTPGetter with memory access violations
Network Indicators:
- Outbound FTP connections to unknown or suspicious IP addresses
- Unusual network traffic patterns following FTP connections
SIEM Query:
source="ftpgetter.log" AND (event="crash" OR event="memory_access_violation") OR dest_port=21 AND src_ip=[internal_range] AND dest_ip NOT IN [approved_ftp_servers]