CVE-2017-18047

Vulnerability

LabF nfsAxe version 3.7 contains a buffer overflow vulnerability in its FTP client component. When the client connects to an FTP server and receives a long reply, the client fails to properly validate the length of the response, leading to a stack-based buffer overflow. This vulnerability is triggered upon connection, specifically when the server sends a crafted reply that overwrites the Structured Exception Handler (SEH) record [1][2][3]. The affected version is 3.7; no other versions are mentioned in the references.

Exploitation

An attacker must set up a malicious FTP server that sends a specially crafted long reply to the victim's nfsAxe FTP client. The victim must connect to the attacker-controlled server (e.g., by using the client to connect to the attacker's IP). No authentication is required; the exploit works with anonymous login [1]. The exploit code overwrites the SEH record and uses a pop/pop/ret gadget to achieve code execution [2]. The exploit has been demonstrated on Windows 7 (x86) and Windows Vista [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's machine with the privileges of the user running the nfsAxe FTP client. This can lead to full compromise of the system, including installation of malware, data exfiltration, or further lateral movement. The payload in the exploit examples is a reverse TCP meterpreter shell [1][2].

Mitigation

As of the publication date (2018-01-22), no official patch or fixed version has been released by LabF. The vendor's website (http://www.labf.com) may no longer be active; the software appears to be end-of-life. The only mitigation is to avoid using nfsAxe 3.7 or to restrict outbound FTP connections to trusted servers. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the time of writing.