CVE-2020-35359
📋 TL;DR
CVE-2020-35359 is a denial-of-service vulnerability in Pure-FTPd where attackers can exhaust connection limits, preventing legitimate users from accessing the FTP server. This affects all systems running vulnerable versions of Pure-FTPd with connection limits configured. The vulnerability allows remote attackers to disrupt FTP services without authentication.
💻 Affected Systems
- Pure-FTPd
📦 What is this software?
Pure Ftpd by Pureftpd
⚠️ Risk & Real-World Impact
Worst Case
Complete FTP service outage preventing all legitimate file transfers and access to hosted content, potentially disrupting business operations dependent on FTP services.
Likely Case
Temporary service degradation where legitimate users experience connection failures or timeouts during attack periods, impacting file transfer operations.
If Mitigated
Minimal impact with proper rate limiting, connection monitoring, and network segmentation in place to detect and block malicious connection attempts.
🎯 Exploit Status
Exploitation requires only basic scripting knowledge to create multiple FTP connections. Public exploit code is available and trivial to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.49 and later
Vendor Advisory: https://github.com/jedisct1/pure-ftpd/releases
Restart Required: Yes
Instructions:
1. Download Pure-FTPd 1.0.49 or later from official repository. 2. Stop the Pure-FTPd service. 3. Install the updated version. 4. Restart the Pure-FTPd service. 5. Verify the service is running with the patched version.
🔧 Temporary Workarounds
Implement Connection Rate Limiting
linuxUse iptables or similar firewall rules to limit connection attempts per IP address
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 21 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
Reduce Connection Limits
linuxLower MaxClients and MaxClientsPerIP values in Pure-FTPd configuration
Edit /etc/pure-ftpd/pure-ftpd.conf and set: MaxClients 50, MaxClientsPerIP 5
🧯 If You Can't Patch
- Implement network-level rate limiting using firewalls or load balancers to restrict connection attempts from single IP addresses
- Deploy intrusion prevention systems (IPS) to detect and block connection flooding patterns
🔍 How to Verify
Check if Vulnerable:
Check Pure-FTPd version: pure-ftpd --version | grep 'pure-ftpd'Check Version:
pure-ftpd --version | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Verify version is 1.0.49 or higher: pure-ftpd --version📡 Detection & Monitoring
Log Indicators:
- Multiple '421' error responses in logs indicating 'Too many connections'
- Rapid succession of connection attempts from single IP addresses
- Increased 'Connection refused' or 'Timeout' messages
Network Indicators:
- High volume of TCP SYN packets to port 21 from single sources
- Multiple simultaneous FTP connections from same IP exceeding normal patterns
SIEM Query:
source="pure-ftpd.log" AND "421" AND "Too many connections" | stats count by src_ip | where count > 10