CVE-2024-48208

HIGHNuclei

Pure-FTPd < 1.0.52 - Buffer Overflow

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-48208 has a selected CVSS score of 8.6 (high); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.

Description

pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in the domlsd() function of the ls.c file.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 28, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

pure-ftpd

Browse pureftpd / pure-ftpd

Default status: unknown

CVE ListBefore 1.0.52affected

Proofs of concept

1

Repository PoCs

GitHubrohilchaudhry/CVE-2024-48208Repository PoCby rohilchaudhry7Not analyzed16 files

2.1 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

rohilchaudhry/CVE-2024-48208Created Vuln labCVE-2024-48208Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based environment that builds a vulnerable pure-ftpd server (version 1.0.50) with SSH access and debugging tools, intended for demonstrating CVE-2024-48208, an out-of-bounds read vulnerability leading to jail escape and broken access control.

Dockerfile:1-107README.md:1-53

Lab assessment

Vulnerability lab

The README explicitly states the repository contains a PoC for CVE-2024-48208, describes the vulnerability, and provides setup instructions for reproducing it. The Dockerfile builds a deliberately vulnerable pure-ftpd server and includes exploit scripts (pure.py, dev_files/working_exploit.py) that demonstrate the OOB read and jail escape.

README.md:1-3README.md:5-53Dockerfile:1-107
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

pure-ftpd server

vulnerable FTP server

A modified pure-ftpd 1.0.50 server compiled from a local tarball. The Dockerfile comments show an alternative build that would reduce the reply buffer size (line 305) and disable the banner (line 4865), but the active build uses the unmodified source. The server is configured with virtual chroot and puredb authentication, and runs with flags -A -E -j -l puredb:/etc/pureftpd.pdb.

Dockerfile:40-50Dockerfile:52-66Dockerfile:100-105

SSH server

remote access for exploit setup

OpenSSH server configured to permit root login and password authentication. It is used by the exploit script pure.py to create a symbolic link on the server before triggering the FTP vulnerability.

Dockerfile:22-25Dockerfile:100-105pure.py:16-33

exploit script (pure.py)

automated exploit

A Python script that uses pwntools and paramiko to connect via SSH, create a symbolic link pointing to an attacker-chosen directory, then connect via FTP, authenticate, trigger the OOB read with an oversized MLSD command, and read the directory listing from the passive port. It demonstrates the jail escape by listing files outside the chroot.

pure.py:1-84

users (bob, eve)

restricted FTP/SSH users

Two local users created with home directories, added to the 'chroot' group, and registered in the pure-ftpd database. They represent restricted users in a chroot jail. The exploit targets these users to escape the jail.

Dockerfile:68-76Dockerfile:92-95

pwndbg

debugging tool

A GDB plugin installed in /opt/pwndbg and sourced in root's .gdbinit. It is a debugging aid for analyzing the vulnerability, not part of the exploit itself.

Dockerfile:28-35

alternative exploit scripts (dev_files/)

supplementary exploit variants

Additional Python scripts (working_exploit.py, cve_automated.py) that demonstrate similar exploit techniques using local symlink creation and oversized MLSD commands. They are referenced in the README as earlier testing scripts.

README.md:47-48dev_files/working_exploit.py:1-40dev_files/cve_automated.py:1-43
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-48208

Supported by supplied evidence

The README explicitly associates the repository with CVE-2024-48208, describes the OOB read in domlsd() due to an unchecked increment, and provides a PoC exploit. The Dockerfile builds the vulnerable pure-ftpd version and the exploit scripts trigger the described behavior.

README.md:1-3README.md:5-15README.md:17-47Dockerfile:40-50pure.py:1-84
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:51-53
  • The attacker needs network access to the FTP (port 21) and SSH (port 22) services exposed by the container.Dockerfile:97
  • Valid credentials for a restricted user (e.g., bob/password0 or eve/password1) are required to authenticate to FTP and SSH.Dockerfile:78-80Dockerfile:92-95
  • The attacker must be able to create a symbolic link on the server (via SSH) pointing to a target directory outside the chroot.pure.py:16-33

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.README.md:51-53
  2. Run the container, exposing ports 21, 22, and 30000-30009.Dockerfile:97
  3. Connect via SSH as a restricted user (e.g., eve) and create a symbolic link pointing to a directory outside the chroot (e.g., /home).pure.py:16-33
  4. Connect to the FTP server, authenticate, and send EPSV to obtain a passive port.pure.py:37-52
  5. Send an oversized MLSD command (e.g., 'MLSD -' padded to >4096 bytes) to trigger the OOB read, causing the server to use the reply buffer content as a directory path.pure.py:60-63
  6. Connect to the previously obtained passive port and read the directory listing, which now shows files from the target directory outside the chroot, demonstrating jail escape.pure.py:66-84
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable FTP server and chroot jail. The exploit scripts connect to the container's services, create a symlink, and read directory listings to demonstrate the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab target.

pure.py:1-84Dockerfile:1-107README.md:1-53
Review boundaries

What the analysis did not establish

  • The pureftpd/pure-ftpd-1.0.50.tar.gz is an uninspected binary archive; its exact contents and any modifications are unknown.
  • The Dockerfile comments show an alternative build with buffer size reduction, but the active build uses the unmodified source; the exact vulnerability surface may differ from the described PoC.
  • The README references images (image.png, image-1.png, image-2.png) that are not included as text, so their content cannot be verified.
  • The VMsetup.txt and DOCKER.md files are not included in the evidence, so alternative setup instructions are unavailable.
  • The dev_files/IMPPPPP file is not included, so its role is unknown.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

Nuclei templates

1
ProjectDiscoveryHIGHPure-FTPd < 1.0.52 - Buffer OverflowCVSS 8.6

Pure-FTPd versions prior to 1.0.52 contain a buffer overflow vulnerability due to an out-of-bounds read in the domlsd() function within the ls.c file. This vulnerability could allow attackers to execute arbitrary code on affected systems.

Impact

Attackers can trigger a buffer overflow in the domlsd() function through crafted FTP commands, potentially executing arbitrary code on the FTP server and compromising the entire system.

Remediation

Upgrade to Pure-FTPd version 1.0.52 or later that fixes the buffer overflow vulnerability in the domlsd() function.

WeaknessesCWE-125
Authorspussycat0x
Template tagscvecve2024networkftppure-ftpdtcppassivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Shodan: product:"Pure-FTPd"
https://github.com/jedisct1/pure-ftpd/pull/176 https://github.com/rohilchaudhry/CVE-2024-48208

Source: ProjectDiscovery

References

2