Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-10-05
• Known to be used in ransomware campaigns
• EPSS: 90% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

CISA: Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 26 Oct 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Co…ExploitThird Party AdvisoryVDB Entry
• attackerkb.com/topics/bn32f9sNax/cve-2023-40044Third Party Advisory
• censys.com/cve-2023-40044Third Party Advisory
• community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023Vendor Advisory
• www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-…ExploitThird Party Advisory
• www.progress.com/ws_ftpProduct
• www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-serverBroken LinkThird Party Advisory
• www.theregister.com/2023/10/02/ws_ftp_updatePress/Media CoverageThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource