FileZilla Client DLL Hijacking Vulnerability Allowing Remote Code Execution

A DLL hijacking vulnerability has been identified in FileZilla Client version 3.63.1. This vulnerability allows attackers to execute malicious code by placing a crafted TextShaping.dll file in the application directory. When FileZilla Client is launched, the application loads the malicious DLL, enabling the execution of arbitrary code. The vulnerability arises because the application does not properly validate the presence of the TextShaping.dll file, creating an opportunity for exploitation.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Reproduction

To reproduce this vulnerability, first create a malicious DLL file using msfvenom, targeting a reverse shell payload. Place the crafted DLL file in the FileZilla Client application directory. When FileZilla Client is launched, the application will load the malicious DLL, resulting in the execution of the reverse shell payload.