CVE-2020-9273

HIGH

ProFTPD 1.3.7 - Use-After-Free in Memory Pool via Data Transfer Channel Interruption

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2020-9273. PoCs published by lockedbyte, dukptkey, ptef.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-9273, a use-after-free vulnerability in ProFTPd leading to remote code execution. The exploit leverages memory leaks via `/proc/self/maps` and hijacks control flow through pool corruption to achieve RCE.

Description

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Exploits (3)

github WORKING POC 690 stars
by lockedbyte · cpoc
https://github.com/lockedbyte/CVE-Exploits/tree/master/CVE-2020-9273

This repository contains a functional exploit for CVE-2020-9273, a use-after-free vulnerability in ProFTPd leading to remote code execution. The exploit leverages memory leaks via `/proc/self/maps` and hijacks control flow through pool corruption to achieve RCE.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: ProFTPd 1.3.7rc2 with mod_copy enabled
Auth required
Prerequisites: Valid user credentials · mod_copy module enabled in ProFTPd
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 14 stars
by dukptkey · poc
https://github.com/dukptkey/CVE-2020-9273

This repository contains functional exploit code for CVE-2020-9273, a use-after-free vulnerability in ProFTPD. The exploit demonstrates remote code execution by manipulating memory structures and includes detailed technical commentary on the exploitation process.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: ProFTPD <= 1.3.7rc2
Auth required
Prerequisites: authenticated FTP access · ability to upload files · knowledge of memory addresses (or brute-forcing)
devstral-2 · analyzed May 30, 2026 Full analysis →
nomisec WORKING POC 12 stars
by ptef · poc
https://github.com/ptef/CVE-2020-9273

This repository contains functional exploit code for CVE-2020-9273, a heap use-after-free vulnerability in ProFTPd. The exploit includes a demo and a reliable version, both demonstrating remote code execution via crafted FTP commands and shellcode.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: ProFTPd (version not explicitly specified, but likely 1.3.7a or earlier)
Auth required
Prerequisites: Authenticated FTP access · Ability to upload files · Localhost testing environment
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (12)

Core 12
Core References
Third Party Advisory x_refsource_confirm
https://github.com/proftpd/proftpd/issues/903
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/02/msg00022.html
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4635
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/03/msg00002.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-35
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/08/25/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/09/06/2

Scores

CVSS v3 8.8
EPSS 0.6022
EPSS Percentile 98.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (10)
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 30
fedoraproject/fedora 31
opensuse/backports_sle 15.0 (2 CPE variants)
opensuse/leap 15.1
proftpd/proftpd 1.3.7
siemens/simatic_net_cp_1543-1_firmware < 3.0
siemens/simatic_net_cp_1545-1_firmware
Published Feb 20, 2020
Tracked Since Feb 18, 2026