A critical buffer overflow vulnerability in Xlight FTP Server 3.9.1 allows local attackers to corrupt memory and potentially execute arbitrary code.

The application contains an out-of-bounds write vulnerability (CWE-787) where a local attacker can supply a crafted 428-byte buffer into the program execution field of the virtual server configuration. This action overwrites the structured exception handler chain, which can be leveraged to crash the application or achieve code execution.

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and availability of the FTP server. Because the vulnerability involves memory corruption, an attacker could potentially gain unauthorized code execution on the host system, leading to full system compromise. With a CVSS score of 8.4, this flaw represents a significant risk to any environment hosting Xlight FTP Server.

Immediate Action: As no official patch is confirmed for this specific version, administrators should restrict access to the virtual server configuration settings to authorized administrative personnel only.

Proactive Monitoring: Audit server logs for unexpected application crashes or service restarts that may indicate attempted buffer overflow exploitation.

Compensating Controls: Ensure that the host system running the FTP service is hardened and that the application process runs with the least privilege necessary to limit the impact of a potential compromise.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 46458).

Given the availability of a public proof-of-concept and the high severity of memory corruption vulnerabilities, organizations using Xlight FTP Server 3.9.1 must prioritize securing the management interface. Limit administrative access to the virtual server configuration to trusted internal personnel and monitor for any signs of service instability that could signal an attempt to trigger this overflow.