CVE-2014-1693

What it actually does

The vulnerability permits CRLF injection in the Erlang/OTP FTP module, allowing context-dependent attackers to append arbitrary FTP commands to inputs for user, account, cd, ls, nlist, rename, delete, mkdir, rmdir, recv, recv_bin, recv_chunk_start, send, send_bin, send_chunk_start, append_chunk_start, append, or append_bin operations.

Why it matters to the business

Systems relying on this component for FTP operations face risk of unauthorized command execution, which can disrupt file transfers, expose sensitive data, or enable further compromise of connected services.

How an attack unfolds

An attacker identifies an application using the vulnerable Erlang FTP module, crafts inputs containing CRLF sequences to inject additional commands such as delete or send, and leverages the injection to manipulate server-side file operations or chain into broader access.

How to fix it

Upgrade Erlang/OTP to a version that resolves the CRLF handling issues in the FTP module; apply vendor patches or replace affected FTP usage with sanitized command construction if upgrades are unavailable.

How to confirm the fix worked

Review FTP command handling code for proper CRLF escaping or sanitization; test by attempting injection of test commands via the affected inputs and confirm no extra commands execute; scan for usage of R15B03 or earlier releases.

Typical attack path

1. Locate services or applications exposing the Erlang FTP client or server functionality
2. Supply malicious input containing CRLF sequences to one of the listed FTP commands
3. Inject and execute arbitrary additional FTP commands on the target
4. Use resulting access to exfiltrate data, modify files, or pivot within the environment

How to detect it

Examine application and FTP logs for unusual sequences of commands, unexpected file operations, or patterns indicating injected CRLF characters; review historical traffic or process logs for anomalies around FTP command execution.

• CRLF sequences followed by additional FTP verbs in command logs
• Unexpected delete, mkdir, or send operations without corresponding user intent

What your security team should do

• Prioritize patching or upgrading all Erlang/OTP deployments using the FTP module
• Audit custom applications for direct use of the vulnerable FTP functions and replace with safe alternatives
• Monitor for any remaining instances of the affected library versions across the ecosystem
• Implement input validation layers around any FTP interactions as a compensating control