CVE-2023-40044criticalunder attackransomwareCWE-502

CVE-2023-40044: critical vulnerability in Progress Software Corporation WS_FTP Server

WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

Published · Updated

Follow this CVE+ Monitor WS FTP Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 90%
from disclosure to weapon5 days
Published on NVDSep 27
1st PoC+5d
metasploitSep 27
CISA KEV+8d
Action required by CISAfederal deadline: 2023-10-26

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

WS_FTP Server has a flaw where attackers can send specially crafted data to the Ad Hoc Transfer module that gets improperly processed, allowing them to run commands on the server without needing to log in first.

Technical detail

A .NET deserialization vulnerability in the Ad Hoc Transfer module (CWE-502) allows pre-authenticated attackers to craft malicious serialized objects that execute arbitrary code with server privileges when deserialized, enabling remote command execution on the underlying OS.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Progress Software Corporation · WS_FTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Progress Software Corporation WS_FTP Server

In the same product, most dangerous first.

CVE-2023-42657CRITICALWS_FTP Server Directory TraversalEPSS 16.0%CVE-2023-42659CRITICALWS_FTP Server Arbitrary File UploadEPSS 1.1%CVE-2023-40046HIGHWS_FTP Server SQL Injection via Administrative InterfaceEPSS 1.0%CVE-2023-40049MEDIUMWS_FTP Server Information Disclosure via Directory ListingEPSS 0.9%CVE-2023-40045HIGHWS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting VulnerabilityEPSS 0.9%CVE-2024-7744MEDIUMImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS_FTP ServerEPSS 0.7%