vsftpd < 3.0.3 - DoS

highseverity

7.5CVSS score

3.2%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

vsftpd before 3.0.3 allows remote attackers to cause a denial of service by sending a crafted FTP command.

Impact

Attackers can send crafted FTP commands to crash the vsftpd daemon, causing denial of service and interrupting FTP services for legitimate users.

Fix

Upgrade to vsftpd version 3.0.3 or later that addresses the denial of service vulnerability.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'vsFTPd') and compare_versions(version, '< 3.0.3')

Run it with nuclei: nuclei -id CVE-2021-30047 -u <target>

The full check

id: CVE-2021-30047

info:
  name: vsftpd < 3.0.3 - DoS
  author: pussycat0x
  severity: high
  description: |
    vsftpd before 3.0.3 allows remote attackers to cause a denial of service by sending a crafted FTP command.
  impact: |
    Attackers can send crafted FTP commands to crash the vsftpd daemon, causing denial of service and interrupting FTP services for legitimate users.
  remediation: |
    Upgrade to vsftpd version 3.0.3 or later that addresses the denial of service vulnerability.
  reference:
    - https://github.com/kuppamjohari/vsftpd-3.0.3-DoS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2021-30047
    epss-score: 0.03213
    epss-percentile: 0.88293
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:3.0.3:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: vsftpd_project
    product: vsftpd
    shodan-query:
      - vsftpd
      - product:"vsftpd"
  tags: cve,cve2021,network,ftp,vsftpd,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"

    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'vsFTPd')"
          - "compare_versions(version, '< 3.0.3')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "vsFTPd ([0-9.]+)"

References

https://github.com/kuppamjohari/vsftpd-3.0.3-DoS

Use this check only on systems you are authorised to test. Where the data comes from