Executive Summary

This vulnerability exists in FileZilla version 3.40.0 and is a denial of service issue within the local search functionality.

Local attackers can cause the application to crash by providing a specially crafted malformed path string.

Specifically, the attacker inputs a path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences into the search directory field and initiates a local search, which triggers the crash.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service condition.

An attacker with local access can crash the FileZilla application, causing disruption of service.

This could lead to loss of availability of the application until it is restarted or the issue is resolved.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered by a local attacker supplying a malformed path string in the local search functionality of FileZilla 3.40.0. Detection involves checking if the application crashes when a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences is entered in the search directory field and a local search is initiated.

Since this is a local denial of service vulnerability, network detection commands are not applicable. Detection should be performed by attempting the described malformed input in a controlled environment to observe if the application crashes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of the local search functionality in FileZilla 3.40.0 until a patch or update is available that addresses this vulnerability.

Additionally, restrict local user access to the FileZilla application to trusted users only, minimizing the risk of exploitation by local attackers.

Useful 0 Not Useful 0