CVE-2024-0546: EasyFTP Denial of Service Vulnerability

CVE-2024-0546 Overview

CVE-2024-0546 is a denial of service vulnerability in EasyFTP 1.7.0. The flaw exists within the LIST command handler component and can be triggered remotely without authentication. An attacker who sends a crafted LIST command to a vulnerable EasyFTP server causes the service to terminate, disrupting file transfer operations. The vulnerability has been publicly disclosed and assigned identifier VDB-250715. The weakness is categorized under [CWE-404] (Improper Resource Shutdown or Release).

Critical Impact

Remote, unauthenticated attackers can crash EasyFTP 1.7.0 servers by sending a malicious LIST command, resulting in service downtime and loss of file transfer availability.

Affected Products

• EasyFTP 1.7.0
• EasyFTP server deployments exposing FTP services over the network
• Systems relying on EasyFTP for file transfer availability

Discovery Timeline

• 2024-01-15 - CVE-2024-0546 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0546

Vulnerability Analysis

The vulnerability resides in the EasyFTP 1.7.0 LIST command handler. The LIST command is a standard File Transfer Protocol (FTP) directive used to enumerate the contents of a directory on the server. When a malformed or unexpected argument reaches this handler, EasyFTP fails to properly shut down or release resources, resulting in process termination.

Because FTP servers are typically network-facing, the attack surface is broad. The Packet Storm advisory describes the issue as a denial of service condition reachable through standard FTP client interactions, requiring no authentication or user interaction on the target side.

Successful exploitation produces a loss of availability for the FTP service. Confidentiality and integrity are not affected, but downstream systems that depend on EasyFTP for automated file delivery will experience disruption until the service is restarted.

Root Cause

The underlying weakness is improper resource shutdown or release [CWE-404] inside the LIST command processing logic. EasyFTP does not validate or contain error states produced during directory listing, allowing a crafted command sequence to terminate the server process.

Attack Vector

An attacker connects to the FTP service over the network and issues a malicious LIST command after the initial protocol handshake. No credentials or social engineering steps are required if the server permits anonymous access or if the attacker holds valid credentials. The malicious command triggers the crash condition in the listing handler. For technical specifics, refer to the Packet Storm DoS Report and the VulDB #250715 Analysis.

Detection Methods for CVE-2024-0546

Indicators of Compromise

• Unexpected termination or repeated restarts of the EasyFTP service process on a host running version 1.7.0.
• FTP control channel sessions that disconnect immediately after a client issues a LIST command.
• Inbound TCP connections to FTP ports (default 21) from unfamiliar external sources followed by service failure.

Detection Strategies

• Monitor EasyFTP process state and capture crash events through the operating system service manager or Windows Event Log.
• Inspect FTP traffic for malformed LIST command arguments or anomalous client behavior preceding service termination.
• Correlate FTP connection logs with service availability metrics to identify denial of service patterns.

Monitoring Recommendations

• Enable verbose logging in EasyFTP and forward logs to a centralized log management or SIEM platform for retention and analysis.
• Configure availability alerts on the FTP listener port so administrators are notified within seconds of a service outage.
• Track source IP addresses that repeatedly trigger FTP disconnections and apply network-level controls to block abusive clients.

How to Mitigate CVE-2024-0546

Immediate Actions Required

• Restrict network access to EasyFTP 1.7.0 servers using firewall rules that allow only trusted source addresses.
• Disable anonymous FTP access where possible to reduce the pool of attackers who can reach the LIST handler.
• Plan migration to a maintained FTP server product, since EasyFTP receives no active vendor support and no patch is referenced for this issue.

Patch Information

No vendor advisory or official patch is referenced in the NVD entry or external references for CVE-2024-0546. Administrators should treat EasyFTP 1.7.0 as end-of-life software and replace it with a supported alternative that receives security updates.

Workarounds

• Place the FTP service behind a VPN or bastion host so the LIST command handler is not exposed to the public internet.
• Deploy a reverse proxy or FTP-aware gateway that filters malformed LIST commands before they reach EasyFTP.
• Implement automatic service restart through the operating system service manager to reduce downtime if the process crashes.
• Migrate hosted content to a supported FTP or SFTP server such as one with active security maintenance.

# Configuration example - restrict EasyFTP exposure with Windows Firewall
netsh advfirewall firewall add rule name="Allow FTP from trusted subnet" ^
    dir=in action=allow protocol=TCP localport=21 ^
    remoteip=10.0.0.0/24
netsh advfirewall firewall add rule name="Block FTP from all others" ^
    dir=in action=block protocol=TCP localport=21