CVE-2021-3331: WinSCP Remote Code Execution Vulnerability

CVE-2021-3331 Overview

CVE-2021-3331 is a critical remote code execution vulnerability in WinSCP, a popular open-source SFTP, FTP, WebDAV, and SCP client for Microsoft Windows. The vulnerability allows remote attackers to execute arbitrary programs by exploiting the application's URL handler with a crafted URL that loads malicious session settings. This is particularly dangerous in default installations where WinSCP is registered as the handler for sftp:// URLs, making exploitation possible through a simple malicious link click.

Critical Impact

Remote attackers can achieve arbitrary code execution on systems where WinSCP is installed as the default protocol handler, requiring no authentication and minimal user interaction.

Affected Products

• WinSCP versions prior to 5.17.10
• Systems with WinSCP registered as the handler for sftp:// URLs
• Default WinSCP installations on Windows operating systems

Discovery Timeline

• 2021-01-27 - CVE-2021-3331 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3331

Vulnerability Analysis

This vulnerability affects WinSCP's URL protocol handler mechanism, which processes specially formatted URLs (such as sftp://) to initiate file transfer sessions. When WinSCP encounters a crafted URL, it can be tricked into loading arbitrary session settings that include executable commands. The attack requires no privileges and can be executed remotely through network-based vectors such as malicious web pages, emails containing crafted links, or other applications that invoke URL handlers.

The vulnerability is particularly severe because WinSCP commonly registers itself as the default handler for secure file transfer protocols during installation. This means that simply clicking a malicious link in a browser, email client, or document viewer could trigger the exploit without any additional user interaction beyond the initial click.

Root Cause

The root cause of CVE-2021-3331 lies in WinSCP's insufficient validation of session settings passed through URL parameters. The application's raw settings functionality allows extensive configuration options to be specified in URLs, including parameters that can specify external programs to execute. Prior to version 5.17.10, WinSCP failed to adequately restrict which settings could be loaded from URLs, allowing attackers to inject malicious configuration directives that result in code execution.

Attack Vector

The attack exploits WinSCP's role as a registered URL protocol handler. An attacker crafts a malicious URL containing embedded session settings that specify an arbitrary program to execute. When a victim clicks the link or visits a page that triggers the URL handler, WinSCP processes the URL and loads the malicious session configuration, resulting in execution of the attacker-specified program with the privileges of the current user.

The following patch was applied to address the vulnerability by preventing the loading of session settings that could lead to remote code execution:

 		<ProjectType>CppConsoleApplication>
 		<SanitizedProjectName>Console</SanitizedProjectName>
 		<VerInfo_IncludeVerInfo>true</VerInfo_IncludeVerInfo>
-		<VerInfo_Keys>CompanyName=Martin Prikryl;FileDescription=Console interface for WinSCP;FileVersion=5.0.1.0;InternalName=console;LegalCopyright=(c) 2000-2020 Martin Prikryl;LegalTrademarks=;OriginalFilename=winscp.com;ProductName=WinSCP;ProductVersion=5.17.10.0;ReleaseType=stable;WWW=https://winscp.net/</VerInfo_Keys>
+		<VerInfo_Keys>CompanyName=Martin Prikryl;FileDescription=Console interface for WinSCP;FileVersion=5.0.1.0;InternalName=console;LegalCopyright=(c) 2000-2021 Martin Prikryl;LegalTrademarks=;OriginalFilename=winscp.com;ProductName=WinSCP;ProductVersion=5.17.10.0;ReleaseType=stable;WWW=https://winscp.net/</VerInfo_Keys>
 		<VerInfo_Locale>1033</VerInfo_Locale>
 		<VerInfo_MajorVer>5</VerInfo_MajorVer>
 		<VerInfo_MinorVer>0</VerInfo_MinorVer>

Source: GitHub Commit Details

Detection Methods for CVE-2021-3331

Indicators of Compromise

• Unexpected WinSCP process execution with unusual command-line parameters containing raw session settings
• Child processes spawned by winscp.exe that are not typical file transfer operations
• Registry modifications to SFTP/SCP URL handler configurations
• Network logs showing access to URLs with embedded WinSCP session configuration parameters

Detection Strategies

• Monitor process creation events for winscp.exe with suspicious URL parameters in command-line arguments
• Implement endpoint detection rules for WinSCP spawning unexpected child processes
• Audit URL handler registrations for sftp://, scp://, and ftp:// protocols on endpoints
• Deploy application control policies to restrict WinSCP execution contexts

Monitoring Recommendations

• Enable detailed command-line logging on Windows endpoints to capture WinSCP invocations
• Configure SIEM alerts for WinSCP process executions originating from browser or email client parent processes
• Monitor for attempts to access WinSCP's raw settings functionality through unusual channels
• Review endpoint telemetry for WinSCP versions prior to 5.17.10

How to Mitigate CVE-2021-3331

Immediate Actions Required

• Upgrade all WinSCP installations to version 5.17.10 or later immediately
• Audit systems to identify vulnerable WinSCP versions across the environment
• Consider temporarily unregistering WinSCP as the default URL handler until patching is complete
• Implement network-level filtering for suspicious URLs targeting WinSCP protocol handlers

Patch Information

WinSCP version 5.17.10 contains the fix for this vulnerability. The patch restricts which session settings can be loaded from URLs, preventing the injection of malicious configuration that could lead to code execution. Organizations should update to this version or later as soon as possible. Detailed information about the fix is available in the WinSCP Version History and the WinSCP Tracker Issue #1943.

Workarounds

• Unregister WinSCP as the default handler for sftp://, scp://, and related URL protocols
• Implement application whitelisting to control how WinSCP can be invoked
• Deploy browser extensions or web filtering to block suspicious URLs targeting WinSCP
• Use Group Policy to prevent automatic URL handler invocations

# Unregister WinSCP as SFTP URL handler via registry (run as Administrator)
reg delete "HKEY_CLASSES_ROOT\sftp" /f
reg delete "HKEY_CLASSES_ROOT\scp" /f
# Note: This will prevent sftp:// and scp:// links from opening in WinSCP
# Re-register after updating to version 5.17.10 or later