CVE-2009-4105

TYPSoft FTP Server 1.10 - APPE DELE Denial of Service

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-4105 has a selected CVSS score of 3.5; EIP currently links 1 catalogued exploit.

Description

TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (crash) by sending an APPE (append) command immediately followed by a DELE (delete) command without sending file data in between these two commands.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBTYPSoft FTP Server 1.10 - APPE DELE Denial of ServiceExploitDB exploitby leinakesiExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that implements a denial-of-service (DoS) exploit against TYPSoft FTP Server 1.10. It authenticates with supplied credentials, then sends APPE and DELE commands in sequence without sending file data, causing the server to crash. The script includes a loop to repeat the attack multiple times.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Python proof-of-concept exploit for CVE-2009-4105, a denial-of-service vulnerability in TYPSoft FTP Server 1.10. It demonstrates how sending APPE followed by DELE in the same connection crashes the server. The code performs only the advertised FTP commands (USER, PASS, PORT, APPE, DELE) against a user-supplied target. No backdoor, reverse shell, data exfiltration, persistence mechanism, or other hidden malicious behavior is present.

ClassificationExploit
Model confidence98%
AuthenticationRequired
Languagespython
Target softwareTYPSoft FTP Server
Attack typesdenial-of-service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable Python code that actively sends crafted FTP commands (APPE followed by DELE) to trigger a server crash, which is the definition of an exploit. The code is not merely checking for the vulnerability; it exercises it to cause denial of service.

exploits/windows/dos/10223.txt:38-102

Requirements

  • Valid FTP credentials (username and password) for the target server.exploits/windows/dos/10223.txt:25-26
  • Network connectivity to the target FTP server on port 21.exploits/windows/dos/10223.txt:24

Observed behavior

  • Connects to the target FTP server on port 21.exploits/windows/dos/10223.txt:59-61
  • Authenticates using the provided username and password.exploits/windows/dos/10223.txt:67-71
  • Sends a PORT command to set up active mode data transfer.exploits/windows/dos/10223.txt:79
  • Sends an APPE command to append to a file.exploits/windows/dos/10223.txt:84
  • Sends a DELE command to delete the same file without sending file data between the commands.exploits/windows/dos/10223.txt:89
  • Repeats the attack sequence in a loop up to 10,000 times.exploits/windows/dos/10223.txt:57
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldConnects to the target FTP server on port 21 using the hostname provided as a command-line argument.exploits/windows/dos/10223.txt:61
Network Connection
Payload withheldBinds a local socket to port 31339 for the FTP active mode data connection, as required by the PORT command.exploits/windows/dos/10223.txt:76
Command Execution
Payload withheldSends standard FTP commands to the target server to trigger the documented denial-of-service condition.exploits/windows/dos/10223.txt:67exploits/windows/dos/10223.txt:71exploits/windows/dos/10223.txt:79exploits/windows/dos/10223.txt:84exploits/windows/dos/10223.txt:89
Review boundaries

What the analysis did not establish

  • Only the single text file (10223.txt) was reviewed; no external dependencies or binary files were included.
  • The review does not assess whether the exploit actually works or is safe to run against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5