CVE-2020-28864
📋 TL;DR
CVE-2020-28864 is a buffer overflow vulnerability in WinSCP 5.17.8 that allows a malicious FTP server to trigger a denial of service or potentially execute arbitrary code by sending an overly long filename. This affects users connecting to untrusted FTP servers with the vulnerable WinSCP version.
💻 Affected Systems
- WinSCP
📦 What is this software?
Winscp by Winscp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise of the client machine.
Likely Case
Denial of service causing WinSCP to crash, potentially disrupting file transfer operations.
If Mitigated
Limited impact if connecting only to trusted FTP servers with proper network segmentation.
🎯 Exploit Status
Exploitation requires client to connect to malicious FTP server. No authentication needed on client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.17.9 and later
Vendor Advisory: https://winscp.net/forum/viewtopic.php?t=30085
Restart Required: No
Instructions:
1. Download latest WinSCP from winscp.net 2. Run installer 3. Follow installation prompts 4. Verify version is 5.17.9 or higher
🔧 Temporary Workarounds
Use SFTP/SCP instead of FTP
windowsSwitch to secure protocols not affected by this vulnerability
Restrict FTP connections
allBlock or limit FTP connections to trusted servers only
🧯 If You Can't Patch
- Disable FTP protocol usage in WinSCP settings
- Implement network controls to restrict FTP connections to trusted servers only
🔍 How to Verify
Check if Vulnerable:
Check WinSCP version in Help > About. If version is exactly 5.17.8, system is vulnerable.Check Version:
winscp.com /versionVerify Fix Applied:
Verify WinSCP version is 5.17.9 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- WinSCP crash logs
- Unexpected FTP connection attempts from WinSCP
Network Indicators:
- FTP connections to unknown servers
- Large filename transfers over FTP
SIEM Query:
source="WinSCP" AND (event_type="crash" OR protocol="FTP" AND filename_length>255)