CVE-2024-1016: Flexbyte Solar FTP Server DOS Vulnerability

CVE-2024-1016 Overview

CVE-2024-1016 is a denial of service vulnerability in Flexbyte Solar FTP Server versions 2.1.1 and 2.1.2. The flaw resides in the PASV (Passive) command handler within the File Transfer Protocol (FTP) implementation. Remote attackers can trigger improper resource handling [CWE-404] by sending crafted PASV commands to the server, causing the service to become unavailable.

The vulnerability requires no authentication, no user interaction, and can be exploited over the network. A public proof-of-concept exists on Packet Storm, increasing exposure risk for internet-facing deployments.

Critical Impact
Unauthenticated remote attackers can crash the Solar FTP Server service through malformed PASV commands, disrupting file transfer operations for all connected users.

Affected Products

Flexbyte Solar FTP Server 2.1.1
Flexbyte Solar FTP Server 2.1.2
All deployments exposing the FTP service on accessible network interfaces

Discovery Timeline

2024-01-29 - CVE-2024-1016 published to NVD with identifier VDB-252286
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1016

Vulnerability Analysis

The vulnerability resides in the PASV Command Handler component of Solar FTP Server. The PASV command instructs the server to enter passive mode and open a secondary data channel for file transfers. When attackers send malformed or repeated PASV commands, the server fails to properly release allocated resources, leading to a service crash or hang.

The weakness is classified under [CWE-404] (Improper Resource Shutdown or Release). This category covers flaws where a program fails to release a resource after it is no longer needed, eventually exhausting available system capacity. In the case of Solar FTP Server, the result is a denial of service condition affecting all clients depending on the service.

Root Cause

The root cause lies in how the PASV command handler manages connection state and resource allocation. The server does not correctly validate or clean up resources tied to passive mode requests. Repeated or crafted PASV commands push the service into an unrecoverable state.

Attack Vector

The attack requires only network access to the FTP port, typically TCP/21. Attackers establish a connection, optionally authenticate where permitted, and issue the malicious PASV sequence. No privileges or user interaction are needed. The exploit has been published on Packet Storm as referenced in the Packet Storm PoC DDoS advisory.

The vulnerability impacts service availability only. It does not lead to code execution, data disclosure, or integrity compromise.

Detection Methods for CVE-2024-1016

Indicators of Compromise

Unexpected termination or unresponsiveness of the Solar FTP Server process on hosts running versions 2.1.1 or 2.1.2
Sudden spike in inbound FTP PASV commands from a single source within a short time window
FTP service restarts or watchdog recovery events appearing in system logs
Connection failures reported by legitimate FTP clients to a previously stable server

Detection Strategies

Monitor FTP control channel traffic for anomalous PASV command sequences and rate spikes from individual source addresses
Correlate Solar FTP Server crash events with network traffic captures to identify the triggering client session
Deploy network intrusion detection signatures targeting the published Packet Storm proof-of-concept payload pattern

Monitoring Recommendations

Enable verbose FTP command logging to capture full client command sequences for forensic review
Track service uptime and process restart frequency for the Solar FTP Server binary
Alert on inbound connections to TCP/21 from untrusted networks, particularly where the service is intended for internal use only

How to Mitigate CVE-2024-1016

Immediate Actions Required

Apply the vendor patch referenced in the VulDB advisory for entry 252286 on all affected Solar FTP Server installations
Restrict network access to TCP/21 using host-based and perimeter firewalls so only trusted source addresses can reach the FTP service
Inventory all systems running Solar FTP Server 2.1.1 and 2.1.2 and prioritize remediation for internet-exposed hosts
Review FTP logs for evidence of exploitation attempts referencing the published proof-of-concept

Patch Information

Flexbyte has released a patch addressing the PASV command handler flaw. Administrators should consult the VulDB CTI entry 252286 for vendor remediation guidance and upgrade to a fixed release. Where a fixed version is not yet deployed, treat the service as exposed and apply compensating controls.

Workarounds

Replace Solar FTP Server with a maintained FTP or SFTP implementation if a vendor patch cannot be applied promptly
Place the FTP service behind a VPN or bastion host to remove direct internet exposure
Configure connection rate limiting at the firewall to throttle repeated PASV command floods from single sources
Disable the FTP service entirely on hosts where file transfer functionality is no longer required

bash

# Example iptables rule restricting FTP access to a trusted subnet
iptables -A INPUT -p tcp --dport 21 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

# Example connection rate limit to slow PASV floods
iptables -A INPUT -p tcp --dport 21 -m conntrack --ctstate NEW \
  -m limit --limit 10/minute --limit-burst 20 -j ACCEPT