CVE-2019-25654: Core FTP/SFTP Server DoS Vulnerability

CVE-2019-25654 Overview

CVE-2019-25654 is a buffer overflow vulnerability affecting Core FTP/SFTP Server version 1.2. The flaw allows remote attackers to crash the FTP/SFTP service by supplying an excessively long string in the User domain field. When attackers paste a malicious payload containing approximately 7000 bytes of data into the domain configuration, it triggers an application crash and results in denial of service.

Critical Impact

Remote attackers can cause a complete denial of service by crashing the Core FTP/SFTP Server through a buffer overflow in the User domain field, disrupting file transfer operations for all users.

Affected Products

• Core FTP/SFTP Server 1.2

Discovery Timeline

• 2026-03-30 - CVE-2019-25654 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2019-25654

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption issue that occurs when the application writes data beyond the boundaries of an allocated buffer. In the case of Core FTP/SFTP Server 1.2, the User domain field does not properly validate the length of input data before copying it into a fixed-size buffer in memory.

When processing configuration data, the server fails to implement adequate boundary checks on the domain field. This allows an attacker to submit a string significantly larger than the allocated buffer space, causing data to be written to adjacent memory regions. The resulting memory corruption leads to an immediate application crash, effectively denying service to legitimate users.

Root Cause

The root cause is insufficient input validation in the User domain field processing routine. The application allocates a fixed-size buffer for domain values but does not enforce length restrictions on user-supplied input. When the server attempts to process a domain string containing 7000 bytes of data, it writes beyond the allocated buffer boundaries, corrupting adjacent memory structures and causing the application to crash.

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker with access to the server's configuration interface can trigger the buffer overflow by:

1. Accessing the User domain configuration field in the Core FTP/SFTP Server administrative interface
2. Submitting an excessively long string (approximately 7000 bytes) as the domain value
3. The server processes the malformed input without proper bounds checking
4. Memory corruption occurs as data overwrites adjacent buffer space
5. The FTP/SFTP service crashes, resulting in denial of service

The attack requires network access to the server but does not require any user interaction or special privileges to execute. Technical details and proof-of-concept information are available through the Exploit-DB #46371 entry.

Detection Methods for CVE-2019-25654

Indicators of Compromise

• Unexpected Core FTP/SFTP Server service crashes or restarts
• Abnormally long strings (>1000 characters) appearing in domain configuration fields
• Event log entries indicating buffer overflow or access violation errors in the FTP server process
• Service availability interruptions without corresponding legitimate administrative actions

Detection Strategies

• Monitor for unusually large HTTP POST or configuration requests targeting the FTP server admin interface
• Configure endpoint detection solutions to alert on application crashes with memory access violation signatures
• Implement network intrusion detection rules to flag oversized domain field values in FTP server traffic
• Deploy SentinelOne Singularity platform to detect and respond to buffer overflow exploitation attempts

Monitoring Recommendations

• Enable detailed application logging for the Core FTP/SFTP Server process
• Configure automated alerting for service crashes or unexpected process termination
• Monitor Windows Event Log for application errors related to the Core FTP service
• Implement availability monitoring to detect service outages that may indicate exploitation

How to Mitigate CVE-2019-25654

Immediate Actions Required

• Restrict administrative access to the Core FTP/SFTP Server configuration interface to trusted IP addresses only
• Implement network segmentation to limit exposure of the FTP server management interface
• Apply any available vendor updates or patches for Core FTP/SFTP Server
• Consider deploying a web application firewall to filter malicious input to the admin interface

Patch Information

Organizations should check the Core FTP Official Site for updated versions that address this vulnerability. The VulnCheck Advisory on Core FTP provides additional technical details and remediation guidance. An archived version of the server is available at the Core FTP Server Download page for reference.

Workarounds

• Restrict network access to the Core FTP/SFTP Server administrative interface using firewall rules
• Place the FTP server behind a reverse proxy with input validation capabilities
• Implement input length restrictions at the network perimeter to reject oversized requests
• Configure automatic service restart policies to minimize downtime in case of exploitation

# Example Windows Firewall rule to restrict admin interface access
netsh advfirewall firewall add rule name="Restrict Core FTP Admin" dir=in action=block protocol=tcp localport=ADMIN_PORT remoteip=any
netsh advfirewall firewall add rule name="Allow Core FTP Admin - Trusted" dir=in action=allow protocol=tcp localport=ADMIN_PORT remoteip=TRUSTED_IP_RANGE