CVE-2023-36049: Microsoft .NET CRLF Injection Arbitrary File Write/Deletion Vulnerability

This report analyzes CVE-2023-36049, an FTP-URI handling vulnerability affecting PowerShell (including versions 7.2–7.4) for which Microsoft released patches in November. It gives detection guidance—monitor FTP traffic on TCP/21 and flag packets containing multiple FTP commands (multiple CRLFs)—and recommends applying the vendor patch or refusing/filtering FTP URIs from untrusted peers as mitigation.