Document Title:
===============
FlashFXP v5.3.0 (Windows) -  Memory Corruption Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1853


Release Date:
=============
2016-06-13


Vulnerability Laboratory ID (VL-ID):
====================================
1853


Common Vulnerability Scoring System:
====================================
5.1


Product & Service Introduction:
===============================
FlashFXP is a FTP, FTPS, SFTP client for Windows. Secure, reliable, and efficient file transfers.
Use FlashFXP to publish and maintain your website. Upload and download files, such as documents, 
photos, videos, music and more! Transfer or backup local and remote files, plus (FXP) server to 
server ftp transfers. FlashFXP offers unique and complimentary advanced features for client 
configuration. Share files with your friends and co-workers (FTP or SFTP server required).

(Copy of the Homepage: https://www.flashfxp.com/ )


Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a local memory corruption vulnerability in the official FlashFXP v5.3.0 windows software.


Vulnerability Disclosure Timeline:
==================================
2016-06-01: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2016-06-02: Vendor Notification (FlashFXP Security Team)
2016-**-**: Vendor Fix/Patch (FlashFXP Security Team)
2016-06-13: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
OpenSight Software
Product: FlashFXP - Software (Client) [Windows] 5.3.0 (Build 3932)


Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Technical Details & Description:
================================
A local memory corruption vulnerability has been discovered in the official FlashFXP v5.3.0 windows software.
The vulnerability allows local attackers to compromise the software process by exploitation of a memory issue.

The vulnerability is located in the `Move file in queue` input function of the `Tools - Schedule - Plan` module.
The input of the `Move file in queue` function is able to compromise the `Tools - Schedule - Plan` module after 
successful exploitation. The `Move file in queue` function has no memory limitation on request only the regular 
exception-handling. Thus results in a unexpected out of memory exception were the attacker can continue to 
process the input. The error is saved into the new generated bug report because of the uncaught unknown exception.
The issue can be trigged automatically by a stable included scheduled plan to compromise or crash the process.

The security risk of the vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 5.1. 
Exploitation of the vulnerability requires a low privileged or restricted system user account without user interaction. 
Successful exploitation of the vulnerability results in unknown exceptions, software process crashs and process compromise.

Vulnerable Module(s):
        [+] Tools - Schedule - Plans

Vulnerable Input(s):
        [+] Move file in queue


Proof of Concept (PoC):
=======================
The memory corruption issue can be exploited by local attackers with low privileged system user account and without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.


Manual steps to reproduce the vulnerability ...
1.  Install the newst flashfpx software version to your windows computer
2.  Open the software process with the interface
3.  Click on top to tools menu on top of the bar
4.  Open the schedule a plan option
5.  Add a new plan to the schedule list module
6.  Include to the in the `Move file in queue` input field a large unicode string as payload to exploit
7.  Save the entry and start the plan (right mouse click or push enter in the mask)
Note: Now the plan is processing the move file in queue input
8.  An exception occurs that shows the error message "Out of Memory" (Memory Corruption)
Note: The exception returns all the time and the software is crashed by a memory corruption
9.  Close the software and start the process again to approve the application-side attack vector
10. Open the tools and switch to the schedule option
11. The software crashs permanently with the save plan by an error exception
Note: The input has been saved since the corruption occurs and is stored!
12. Successful reproduce of the vulnerability!


--- Exception Handling Bug Report Records ---
date/time           : 2016-05-31, 19:16:47
computer name       : X01 Session 2016
user name           : Benjamin Kunz Mejri
operating system    : Windows 10 x64 build 10586
processors          : 4x Intel(R) Core(TM) i5-4210M CPU @ 2.60GHz
process id          : $354
allocated memory    : 2,92 GB
largest free block  : 222,84 MB
executable          : FlashFXP.exe
exec. date/time     : 2016-05-06 18:23
executable hash     : 08CFB10FC665C75047FE895D7517973D
version             : 5.3.0.3932
SSE2                : 1
WinOSCompatMode     : 0
ID                  : b07af5b3110aa75f4bd313454fd40c49
Install Mode        : Per User - User data folder
AppFolder           : C:Program Files (x86)FlashFXP 5
DataFolder          : C:UsersAdminAppDataRoamingFlashFXP5
TempFolder          : C:UsersAdminAppDataLocalTemp
Themes Available    : 1
Themes Active       : 1
App Instance Count  : 1
ANSI code page      : 1252
Thread locale       : 1031
User Default Locale : 1031
PixelsPerInch       : 96
ScreenReader        : 0
PrevBuild           : 0
MouseOverCtrl       : TQueueStorage.Queue
Active Form         : TFrmTskSchd (FrmTskSchd)
Forms               : TFrmTskSchd, TFrmMain, TTntForm
Active Ctrl         : TPTListView (LV)
APPE                : 0
WideChar Test       : 0
callstack crc       : $8fd89c21, $956cbda8, $15fea25c
exception number    : 1
exception class     : EOutOfMemory
exception message   : Out of memory.


Note: The report is generated by the process via software exception-handling


--- Vulnerable Process Log ---
00920000 FlashFXP.exe - 5.3.0.3932 - C:Program Files (x86)FlashFXP 5


--- CPU Registers Log ---
eax = 02fb1b50
ebx = 009ad6dd
ecx = cc5bedf0
edx = 009ad6dd
esi = 009ad6dd
edi = 005fdc34
eip = 009ad6dd
esp = 005fdbc8
ebp = 005fdc4c


--- Stack Dump Log ---
005fdbc8  dd d6 9a 00 de fa ed 0e - 01 00 00 00 07 00 00 00  ................
005fdbd8  dc db 5f 00 dd d6 9a 00 - 50 1b fb 02 dd d6 9a 00  .._.....P.......
005fdbe8  dd d6 9a 00 34 dc 5f 00 - 4c dc 5f 00 f8 db 5f 00  ....4._.L._..._.
005fdbf8  01 00 00 00 dc 17 92 00 - 04 00 00 00 30 b6 eb 02  ............0...
005fdc08  dd d6 9a 00 05 00 00 00 - 2c e4 5f 00 f8 3e c4 00  ........,._..>..
005fdc18  fa 55 c4 00 74 dc 5f 00 - f8 32 92 00 4c dc 5f 00  .U..t._..2..L._.
005fdc28  6c de 5f 00 6c de 5f 00 - 40 3e 8a 05 00 00 00 00  l._.l._.@>......
005fdc38  00 00 00 00 00 00 00 00 - 00 00 00 00 6c de 5f 00  ............l._.
005fdc48  40 3e 8a 05 a4 dd 5f 00 - 70 b6 c5 00 7c dc 5f 00  @>...._.p...|._.
005fdc58  00 00 00 00 6c de 5f 00 - 40 3e 8a 05 4e bc 00 00  ....l._.@>..N...
005fdc68  6c de 5f 00 40 3e 8a 05 - 29 da b6 00 e4 dd 5f 00  l._.@>..)....._.
005fdc78  37 34 92 00 a4 dd 5f 00 - 4e bc 00 00 6c de 5f 00  74...._.N...l._.
005fdc88  40 3e 8a 05 00 00 00 00 - c0 b6 33 01 00 00 00 00  @>........3.....
005fdc98  ac 47 78 75 fd 0b 01 c5 - da 01 00 00 1a 00 00 00  .Gxu............
005fdca8  01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
005fdcb8  00 00 00 00 e8 03 00 00 - 00 00 00 00 ff ff ff ff  ................
005fdcc8  00 00 00 00 00 00 00 00 - c0 fa 2d 01 20 dd 5f 00  ..........-. ._.
005fdcd8  05 00 00 00 ff ff ff ff - c0 b6 33 01 00 00 00 00  ..........3.....
005fdce8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................
005fdcf8  00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00  ................


--- Disassembler Log ---
[...]
00c5b648        jmp     loc_c5b6a9
00c5b648
00c5b648      ; ---------------------------------------------------------
00c5b648
00c5b64a      loc_c5b64a:
00c5b64a 1396   cmp     word ptr [ebx+$3ca], 0
00c5b652        jz      loc_c5b667
00c5b652
00c5b654 1397   lea     ecx, [edx+$c]
00c5b657        mov     edx, ebx
00c5b659        mov     eax, [ebx+$3cc]
00c5b65f        call    dword ptr [ebx+$3c8]
00c5b65f
00c5b665        jmp     loc_c5b6b2
00c5b665
00c5b665      ; ---------------------------------------------------------
00c5b665
00c5b667      loc_c5b667:
00c5b667 1400   mov     edx, edi
00c5b669        mov     eax, ebx
00c5b66b      > call    -$1628c ($c453e4)      ; TntComCtrls.TTntCustomListView.CNNotify
00c5b66b
00c5b670        jmp     loc_c5b6b2
00c5b670
00c5b670      ; ---------------------------------------------------------
00c5b670
00c5b672      loc_c5b672:
00c5b672 1411   cmp     word ptr [ebx+$482], 0
00c5b67a        jz      loc_c5b69e
00c5b67a
00c5b67c 1413   push    esp
00c5b67d        call    -$333d1e ($927964)     ; Windows.GetCursorPos
00c5b67d
00c5b682 1414   lea     ecx, [esp+8]
00c5b686        mov     edx, esp
00c5b688        mov     eax, ebx
00c5b68a        call    -$ef6eb ($b6bfa4)      ; Controls.TControl.ScreenToClient
00c5b68a
00c5b68f        lea     edx, [esp+8]
00c5b693        mov     eax, ebx
00c5b695        mov     si, $ffaa
[...]


Solution - Fix & Patch:
=======================
The vulnerability can be patched by an allocate of the memory or limitation and restriction of the vulnerable input fields.
Disallow to continue the process input via debugger to prevent exploitation of the memory corruption issue.


Security Risk:
==============
The security risk of the local memory corruption vulnerability in the schedule plan module of the software is estimated as medium. (CVSS 5.1)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (research@vulnerability-lab.com) [http://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, 
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, 
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised 
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com     - www.vuln-lab.com             - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com   - research@vulnerability-lab.com         - admin@evolution-sec.com
Section:    magazine.vulnerability-lab.com   - vulnerability-lab.com/contact.php         - evolution-sec.com/contact
Social:      twitter.com/vuln_lab    - facebook.com/VulnerabilityLab         - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php       - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php   - vulnerability-lab.com/list-of-bug-bounty-programs.php   - vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically 
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or 
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific 
authors or managers. To record, list, modify, use or edit our material contact (admin@ or research@vulnerability-lab.com) to get a ask permission.

            Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™


-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com