Pure-FTPd 1.0.48 - Denial of Service

highseverity

7.5CVSS score

4.5%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Pure-FTPd 1.0.48 is vulnerable to Denial of Service via exhaustion of connections due to lack of proper connection limits.

Impact

Unauthenticated attackers can exhaust available connections due to lack of proper connection limits, causing denial of service by preventing legitimate users from connecting to the FTP server.

Fix

Update Pure-FTPd to a version newer than 1.0.48 that implements proper connection limits and rate limiting to prevent connection exhaustion attacks.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'Pure-FTPd') and contains(version, '1.0.48')

Run it with nuclei: nuclei -id CVE-2020-35359 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-35359

info:
  name: Pure-FTPd 1.0.48 - Denial of Service
  author: pussycat0x
  severity: high
  description: |
    Pure-FTPd 1.0.48 is vulnerable to Denial of Service via exhaustion of connections due to lack of proper connection limits.
  impact: |
    Unauthenticated attackers can exhaust available connections due to lack of proper connection limits, causing denial of service by preventing legitimate users from connecting to the FTP server.
  remediation: |
    Update Pure-FTPd to a version newer than 1.0.48 that implements proper connection limits and rate limiting to prevent connection exhaustion attacks.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2020-35359
    cwe-id: CWE-770
    epss-score: 0.04465
    epss-percentile: 0.91522
    cpe: cpe:2.3:a:pureftpd:pure-ftpd:1.0.48:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: pureftpd
    product: pure-ftpd
    shodan-query:
      - product:"pure-ftpd"
      - cpe:"cpe:2.3:a:pureftpd:pure-ftpd"
  tags: cve,cve2020,network,ftp,pure-ftpd,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'Pure-FTPd')"
          - "contains(version, '1.0.48')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "Pure-FTPd ([0-9.]+)"

Use this check only on systems you are authorised to test. Where the data comes from