CVE-2020-37107: Core FTP LE DoS Vulnerability

CVE-2020-37107 Overview

CVE-2020-37107 is a buffer overflow vulnerability affecting Core FTP LE version 2.2 that allows attackers to cause a denial of service condition. The vulnerability exists due to improper handling of input in the account field, where overwriting the field with an excessively large buffer causes the application to crash and become unresponsive.

Critical Impact

Successful exploitation crashes Core FTP LE, requiring application reinstallation to restore functionality.

Affected Products

• Core FTP LE 2.2

Discovery Timeline

• 2026-02-07 - CVE-2020-37107 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2020-37107

Vulnerability Analysis

This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The root cause lies in the application's failure to validate the length of user-supplied input before copying it into a fixed-size buffer within the account field. When an attacker supplies approximately 20,000 characters to this field, the input exceeds the allocated buffer space, causing memory corruption that results in application instability and eventual crash.

The attack requires local access and user interaction, as the attacker must either have direct access to the application interface or convince a user to paste malicious content into the account field. While this limits the attack surface, the impact is significant as it renders the application completely unusable until reinstallation.

Root Cause

The vulnerability stems from insufficient input validation in the account field handling code. The application fails to implement proper bounds checking when processing user input, allowing data that exceeds the expected buffer size to be written to memory. This is a classic buffer overflow condition where the software copies data from a source buffer to a destination buffer without verifying that the destination has adequate space to accommodate the incoming data.

Attack Vector

The attack is executed locally and requires user interaction. An attacker can exploit this vulnerability by creating a text file containing approximately 20,000 repeated characters and pasting this content into the account field within the Core FTP LE application. Upon processing this oversized input, the application's buffer is overwritten, leading to memory corruption and a denial of service condition.

The exploitation process involves:

1. Creating a text payload with approximately 20,000 characters
2. Opening Core FTP LE version 2.2
3. Pasting the payload into the account field
4. The application crashes and becomes unresponsive
5. Reinstallation is required to restore functionality

Technical details and a proof of concept are available at Exploit-DB #48137.

Detection Methods for CVE-2020-37107

Indicators of Compromise

• Core FTP LE application crashes unexpectedly during connection configuration
• Presence of unusually large text files or clipboard content containing repeated characters
• Application logs showing buffer-related errors or memory access violations
• System event logs indicating application termination due to unhandled exceptions

Detection Strategies

• Monitor for abnormal application crashes or termination events related to Core FTP LE processes
• Implement endpoint detection rules to identify clipboard content exceeding reasonable input lengths
• Use application whitelisting to detect unauthorized modifications to Core FTP LE installations
• Deploy behavioral analysis to detect repeated application reinstallation attempts

Monitoring Recommendations

• Enable Windows Event Log monitoring for application crash events involving coreftp.exe
• Configure endpoint protection to alert on repeated application reinstallations
• Monitor file system activity for creation of text files with unusually large repetitive content
• Implement user behavior analytics to detect anomalous interaction patterns with FTP client applications

How to Mitigate CVE-2020-37107

Immediate Actions Required

• Upgrade to a patched version of Core FTP LE if available from the vendor
• Implement access controls to restrict who can interact with the Core FTP LE application
• Consider using alternative FTP clients that are not affected by this vulnerability
• Apply input validation at the operating system or endpoint protection level

Patch Information

Users should check the Core FTP Official Website for updated versions that address this vulnerability. The Core FTP Download Page provides access to the latest releases. Additionally, the VulnCheck Core FTP Advisory may contain additional remediation guidance.

Workarounds

• Restrict physical and remote access to systems running Core FTP LE 2.2
• Educate users about the risks of pasting untrusted content into application fields
• Consider deploying application sandboxing to limit the impact of potential crashes
• Implement endpoint protection solutions that can detect and block buffer overflow attempts

Administrators should limit the use of vulnerable versions and prioritize upgrading to a patched release when available from the vendor.