X41 D-Sec GmbH Security Advisory: X41-2017-006

Multiple Vulnerabilities in PSFTPd Windows FTP Server


Summary and Impact

Several issues have been identified, which allow attackers to hide information in log files, recover passwords and crash the whole server.

It uses neither ASLR nor DEP to make exploitation harder.

Product Description

From the vendor page, roughly translated:
PSFTPd is a userfriendly, functional and robust FTP server software with support for FTP, FTPS and SFTP.

Use after free

Summary and Impact

An invalid memory access issue could be triggered remotely in the SFTP component of PSFTPd. This issue could be triggered prior authentication. The PSFTPd server did not automatically restart, which enabled attackers to perform a very effective DoS attack against this service. By sending the following SSH identification / version string to the server, a NULL pointer dereference could be triggered:

$ cat tmp.14

$ cat tmp.14 | socat - TCP:

The issue appears to be a race condition in the window message handling, performing the cleanup for invalid connections. Upon further investigation X41 D-Sec GmbH could confirm that the accessed memory was already freed.

X41 D-Sec GmbH enabled the memory debugging functionality page heap for the psftpd_svc.exe exeutable using the command “gflags.exe /p /disable psftpd_svc.exe /full”. When observing the crash in the WinDBG 19 debugging tool, it could be confirmed that access to an already freed page was taking place.

Log Injection

Summary and Impact

The PSFTPd server does not properly escape data before writing it into a Comma Separated Values (CSV) file. This can be used by attackers to hide data in the Graphical User Interface (GUI) view and create arbitrary entries to a certain extent. Special characters as ‘”’, ‘,’ and ‘\r’ are not escaped and can be used to add new entries to the log.



Passwords stored in Plain Text

Summary and Impact

The PSFTPd server stores its configuration inside the PSFTPd.dat. This file is a Microsoft Access Database and can be extracted by using the command “mdb-export PSFTPd.dat USERS” from mdbtools (https://github.com/brianb/mdbtools). The application sets the encrypt flag with the password “ITsILLEGAL”, but this is not required to extract the data. The users password is shown in clear text, since it is not stored securely.


Use the Active Directory connector for your users.

FTP Bounce Scan

Summary and Impact

The PSFTPd server does not prevent FTP bounce scans by default. These can be performed using “nmap -b” and allow to perform scans via the FTP server.


It is possible to prevent FTP bounce scans by setting: Kontrollmanager > Domain > Sicherheit > Register “FTP Bounce and FXP”

About X41 D-Sec GmbH

X41 D-Sec is a provider of application security services. We focus on application code reviews, design review and security testing. X41 D-Sec GmbH was founded in 2015 by Markus Vervier. We support customers in various industries such as finance, software development and public institutions.