CVE-2024-0737 Overview
CVE-2024-0737 is a denial-of-service vulnerability affecting Xlight FTP Server version 1.1 from Xlightftpd. The flaw resides in the Login component and is triggered by manipulating the user argument during authentication. A remote attacker can send crafted input to exhaust or improperly release server resources, causing the FTP service to become unavailable. The issue is tracked as VDB-251560 and is categorized under [CWE-404] Improper Resource Shutdown or Release. Public disclosure of the exploit technique has occurred through Packet Storm, increasing the likelihood of opportunistic scanning against exposed FTP endpoints.
Critical Impact
Unauthenticated remote attackers can crash or hang the Xlight FTP Server 1.1 service by supplying malformed input to the login user field, denying access to legitimate users.
Affected Products
- Xlightftpd Xlight FTP Server 1.1
- CPE: cpe:2.3:a:xlightftpd:xlight_ftp_server:1.1:*:*:*:*:*:*:*
- Deployments exposing the FTP Login component to untrusted networks
Discovery Timeline
- 2024-01-19 - CVE-2024-0737 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0737
Vulnerability Analysis
The vulnerability affects the authentication flow of Xlight FTP Server 1.1. When the server processes a login attempt, the handling of the user argument fails to properly release or bound resources, mapping to [CWE-404] Improper Resource Shutdown or Release. An attacker sending crafted USER commands can push the daemon into a state where it no longer accepts new connections or terminates unexpectedly.
The attack requires no authentication and no user interaction. Because FTP servers are commonly reachable across network boundaries, the exposure surface is broad on hosts where the service is internet-facing. The EPSS score of 4.195% (89th percentile) reflects meaningfully elevated exploitation probability relative to the broader CVE population.
Root Cause
The root cause is improper resource management in the login handler. The service does not correctly constrain or clean up resources allocated while parsing the user parameter. Repeated or malformed submissions therefore lead to service disruption rather than a controlled authentication failure.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker connects to the exposed FTP control port and issues an FTP USER command containing the malformed argument documented in the public proof of concept. Repeated delivery or a single crafted payload is sufficient to render the server unresponsive. Public technical detail is available in the Packet Storm PoC and the VulDB #251560 entry.
No verified exploit code is reproduced here. Refer to the linked advisory for the exact request structure used to trigger the condition.
Detection Methods for CVE-2024-0737
Indicators of Compromise
- Unexpected termination or hang of the Xlight FTP Server process on a host running version 1.1
- Bursts of inbound FTP USER commands from a single source followed by connection resets or timeouts
- Loss of FTP service availability without corresponding administrator action or scheduled maintenance
Detection Strategies
- Monitor FTP control-channel traffic on TCP/21 for anomalously long, malformed, or repeated USER command arguments
- Track process health and restart counts for xlight.exe or the equivalent service binary, alerting on abnormal crash frequency
- Correlate network anomalies with local service crash events to distinguish DoS attempts from legitimate operational faults
Monitoring Recommendations
- Ingest FTP server logs into a centralized logging or SIEM platform and build detections for repeated failed login attempts from single sources
- Alert on service availability drops using synthetic FTP login probes from a monitoring host
- Baseline typical USER argument length and character set, and flag statistical deviations
How to Mitigate CVE-2024-0737
Immediate Actions Required
- Restrict inbound access to the Xlight FTP Server to trusted source IP ranges using firewall or ACL controls
- Remove Xlight FTP Server 1.1 from internet-facing exposure until a vendor-supplied fixed build is installed
- Increase monitoring of FTP service health and be prepared to restart the service automatically on failure
Patch Information
No vendor advisory URL is listed in the NVD record for CVE-2024-0737 at the time of publication. Administrators should consult the Xlight FTP Server vendor site for a newer release than 1.1 and upgrade to a version that no longer contains the vulnerable login handler. Reference tracking is available via VulDB #251560.
Workarounds
- Place the FTP server behind a network gateway or reverse proxy that enforces strict input length limits on FTP USER arguments
- Migrate to an alternative FTP or SFTP server implementation if a fixed Xlight build is not available for the environment
- Enforce source IP allow-listing so only authorized clients can reach the FTP control channel
- Configure automated service supervision to restart the daemon quickly after a crash, reducing the availability impact window
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
