CVE-2020-9273: a use-after-free in ProFTPd

CVE-2020-9273 is a heap use-after-free in ProFTPd, present through version 1.3.7rc2. It lives in the memory pool the server uses to build its command responses. If an FTP control connection is closed while a data transfer is still moving on its own connection, that response pool is freed — and then reused a moment later, when the server goes to write a response back to a client that is no longer there.

Triggering it needs a real foothold rather than a clever packet: valid credentials, write access to a directory, an upload begun in passive mode, and the control connection dropped in the middle of the transfer. What makes it worth the setup is the degree of control that follows. The attacker holds both the control channel and the data channel, and with them decides what ProFTPd is trying to write when the freed pool is reused. That turns the use-after-free into a write-what-where primitive, and from there the exploit redirects the server’s own cleanup routines — the callbacks it runs when a connection tears down — into remote code execution, as the user the daemon runs as.

The exploit, the matching ProFTPd source, and a working proof of concept are in the repository: github.com/dukptkey/CVE-2020-9273. The full reasoning — grooming the pool, joining the two channels, walking the write primitive up to control of execution — is in Phrack 72, “A learning approach on exploiting CVE-2020-9273”, written to be followed and reproduced rather than just read.