CVE-2019-25619: FTP Shell Server Buffer Overflow Flaw

CVE-2019-25619 Overview

CVE-2019-25619 is a stack-based buffer overflow [CWE-787] in FTP Shell Server 6.83. The flaw resides in the Account name to ban field within the Manage FTP Accounts dialog. A local attacker can supply a crafted account name string to overwrite the return address on the stack and redirect execution to attacker-controlled shellcode. Public proof-of-concept code demonstrates execution of calc.exe, but any arbitrary command can be executed in the context of the running user.

Critical Impact
Successful exploitation grants arbitrary code execution on the host running FTP Shell Server 6.83, compromising confidentiality, integrity, and availability of the affected system.

Affected Products

FTP Shell Server 6.83
cpe:2.3:a:ftpshell:ftpshell_server:6.83:*:*:*:*:*:*:*
Windows installations using the vulnerable Manage FTP Accounts component

Discovery Timeline

2026-03-22 - CVE-2019-25619 published to NVD
2026-04-03 - Last updated in NVD database

Technical Details for CVE-2019-25619

Vulnerability Analysis

The vulnerability is a classic stack buffer overflow triggered through the application's account management interface. FTP Shell Server 6.83 copies user-supplied data from the Account name to ban input field into a fixed-size stack buffer without enforcing length validation. When the supplied string exceeds the buffer capacity, adjacent stack memory is overwritten, including the saved return address of the surrounding function.

Attackers craft an input that contains shellcode and a precise offset to control execution flow. Once the vulnerable function returns, control transfers to the attacker-supplied payload. Because exploitation occurs through a local GUI interaction, the attacker must already have access to the system, but the resulting code execution inherits the privileges of the FTP Shell Server process.

The issue is catalogued under CWE-787 Out-of-bounds Write. Public exploitation details are available in Exploit-DB #46685 and the VulnCheck Advisory.

Root Cause

The root cause is the absence of bounds checking on the account name input. The application uses an unsafe string copy routine to transfer user data into a stack-allocated buffer. No length validation, canary check, or safe API replacement (such as strncpy_s) is performed before the copy.

Attack Vector

The attack vector is local. An authenticated user with access to the FTP Shell Server administrative interface opens the Manage FTP Accounts dialog and pastes a crafted string into the Account name to ban field. The payload contains NOP sleds, shellcode, and a return address that pivots execution into the attacker-controlled buffer. No verified code is reproduced here; see Exploit-DB #46685 for the public proof of concept.

Detection Methods for CVE-2019-25619

Indicators of Compromise

Unexpected child processes spawned from ftpshell.exe or related FTP Shell Server binaries, such as calc.exe, cmd.exe, or powershell.exe
Crash events or Windows Error Reporting entries citing access violations in FTP Shell Server when interacting with the Manage FTP Accounts dialog
Configuration files or account databases containing abnormally long account name strings with non-printable bytes

Detection Strategies

Monitor process creation events where the parent is ftpshell.exe and the child is an interpreter or living-off-the-land binary
Inspect memory protection violations and exception logs on hosts running FTP Shell Server 6.83
Hunt for binaries matching the FTP Shell Server 6.83 file hash across the environment to inventory vulnerable installations

Monitoring Recommendations

Enable Windows Defender Exploit Guard or equivalent exploit mitigations and forward telemetry to a central SIEM
Audit local logons and remote desktop sessions on hosts that run FTP Shell Server, since exploitation requires local access
Alert on modifications to the FTP Shell Server account configuration store outside scheduled administrative windows

How to Mitigate CVE-2019-25619

Immediate Actions Required

Inventory all systems running FTP Shell Server 6.83 and isolate them from untrusted users
Restrict access to the Manage FTP Accounts interface to a minimal set of administrators
Remove or uninstall FTP Shell Server 6.83 where the functionality is no longer required

Patch Information

No vendor advisory or patched release is referenced in the available CVE data. Refer to the FTPShell Homepage for current product status and contact the vendor to confirm whether a fixed version is available. Until a patched build is verified, treat all 6.83 installations as vulnerable.

Workarounds

Run FTP Shell Server under a dedicated low-privilege service account to limit the impact of code execution
Apply application allowlisting to prevent ftpshell.exe from spawning interpreters or scripting hosts
Enforce Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) system-wide to raise exploitation cost

bash

# Configuration example: enable system-wide DEP and ASLR on Windows
bcdedit.exe /set {current} nx AlwaysOn
Set-ProcessMitigation -System -Enable DEP,BottomUp,ForceRelocateImages