ZDI-23-1639: Microsoft .NET FormatFtpCommand CRLF Injection Arbitrary File Write and Deletion Vulnerability

This vulnerability allows remote attackers to create or delete arbitrary files on FTP servers implemented using affected versions of Microsoft .NET. Interaction with the .NET framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 7.6. The following CVEs are assigned: CVE-2023-36049.

arbitrary files arbitrary file write attack attackers attack vectors crlf injection cvss delete deletion exploit file files framework ftp implementation injection may microsoft microsoft .net rating servers vulnerability zdi