External risk intelligence

WinSCP URL Handler Arbitrary Program Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-3331

WinSCP is a client-side application used by individual users to manage files. While it may handle URLs, it is not an internet-facing service, gateway, or web application. Public-internet exposure is uncommon for this type of software, as it typically runs on local end-user systems and requires user interaction to process external input.

Winscp

before 5.17.10

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in WinSCP, a file transfer application, where a specially crafted URL could allow remote attackers to execute arbitrary programs on a user's system. This impacts the security of systems that use WinSCP, particularly if it is configured to handle specific URL types.

A vulnerability allows remote program execution via crafted URLs.
It matters if WinSCP handles specific URL types on your systems.
Confirm if WinSCP is used and handles URLs to assess relevance.

Attack Path

How an attacker could exploit the issue

Attackers can remotely send specially crafted URLs to a user's machine. If the user clicks such a link, it could cause WinSCP to load malicious session settings, leading to the execution of arbitrary programs. This is particularly concerning if WinSCP is configured to handle specific URL types, like SFTP links, by default.

Requires user interaction to click a link.
Triggered by a crafted URL handler.
Leads to arbitrary program execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to execute arbitrary programs on a user's system when they encounter a specially crafted URL that triggers WinSCP to load session settings, particularly when WinSCP is configured to handle sftp:// URLs.

User's system.
Via specially crafted URLs.
Arbitrary program execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

WinSCP, a client-side file transfer application, is likely managed by individual user systems, making its ownership typically fall under end-user support or device management teams. The first step is to identify users with WinSCP installed, assess if it's configured to handle sftp:// URLs, and confirm whether user interaction could lead to arbitrary program execution. Once identified and risk-assessed, remediation or user guidance can be planned.

End-user support or device management owns the issue.
Verify WinSCP is installed and handles sftp:// URLs.
Guide users on safe URL handling and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WinSCP?

WinSCP is a popular client-side application used primarily for secure file transfers between local and remote computers. Users typically rely on it to manage files over protocols like SFTP, FTP, and SCP within Windows environments. Because it acts as a file manager and transfer tool, it often integrates with the operating system to handle specific URL schemes, which allows users to initiate connections directly from web browsers or other applications.

How does CVE-2021-3331 lead to arbitrary program execution?

This vulnerability involves an issue with how the application processes session settings from a URL. When a crafted URL is opened, the software may inadvertently treat parts of that URL as configuration instructions, potentially loading malicious settings. If these settings are manipulated, the application might execute unauthorized programs on the host machine, bypassing intended security boundaries during the connection process.

What triggers this vulnerability in WinSCP?

The flaw is triggered when the application's URL handler processes a specifically designed, malicious URL, such as an sftp:// link. It is important to note that simply having the software installed is not enough to trigger the bug; the system must be configured to use WinSCP as the default handler for these URLs, and the application must be coerced into interpreting the malicious link's parameters as valid session settings.

Is my system at risk if I run WinSCP?

While the vulnerability is severe, Halo Surface Signal notes that WinSCP is generally a client-side tool rather than an internet-facing server or gateway. Because it typically resides on individual end-user workstations, it is rarely exposed directly to the public internet. The primary risk profile involves users who might inadvertently click on malicious, crafted links while using a browser or other application that passes those URLs to WinSCP.

What should I do if I use WinSCP?

Begin by identifying which systems in your environment have WinSCP installed. Verify whether these installations are configured to handle SFTP or other protocol URLs by default. Prioritize updating the software to version 5.17.10 or later, which addresses the URL handling flaw, and communicate safe browsing habits to users to prevent them from interacting with untrusted or suspicious links.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.