Executive brief
Xlight FTP Server is a Windows-based application used for secure file transfers. A security vulnerability in version 3.9.1 allows a local user to crash the server or potentially take full control of the system by entering a specially crafted long string into the server's configuration settings. This could lead to a total loss of service or unauthorized access to sensitive files and corporate data.
Technical details
A stack-based buffer overflow exists in Xlight FTP Server 3.9.1 due to improper bounds checking in the 'program execution' field within the virtual server configuration. An attacker with local access to the configuration interface can provide a crafted 428-byte payload that overwrites the Structured Exception Handler (SEH) chain. When an exception is subsequently triggered, the corrupted SEH pointer allows the attacker to redirect execution flow. While the primary impact is a denial-of-service (application crash), the ability to control the SEH chain enables potential arbitrary code execution. A proof-of-concept exploit is publicly available. Newer versions (e.g., 3.9.5) are available, though the advisory specifically identifies 3.9.1 as vulnerable.
Affected products
- Xlightftpd Xlight FTP Server 3.9.1
Timeline
- 2019-02-24: disclosed: Initial discovery and PoC by Logan Whitmire
- 2026-04-05: advisory: NVD/VulnCheck publication of CVE-2019-25681