Skip to main content
Creating a new NHS England: Health Education England, NHS Digital and NHS England have merged. More about the merger.

Progress Issues Security Update for Critical Vulnerabilities in WS_FTP Server

The security update addresses two critical vulnerabilities, three high vulnerabilities and three medium vulnerabilities.

Threat ID:
CC-4385
Threat Severity:
High
Published:
29 September 2023 12:08 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The security update addresses two critical vulnerabilities, three high vulnerabilities and three medium vulnerabilities.

Affected platforms

The following platforms are known to be affected:

Versions: all versions

Progress (formerly Ipswitch) WS_FTP Server

Threat details

Exploitation of CVE-2023-40044

A proof-of-concept has been publicly released for CVE-2023-40044 and the vulnerability has been seen actively exploited in the wild.

Introduction

Progress (formerly Ipswitch) has released security updates for two critical vulnerabilities, three high vulnerabilities and three medium vulnerabilities found in the WS_FTP Server.

Vulnerability details

  • CVE-2023-40044 - CWE 502 - This is a .NET deserialization vulnerability in the Ad Hoc Transfer module affecting WS_FTP Server versions prior to 8.7.4 and 8.8.2/ A "pre-authenticated" attacker could exploit this vulnerability to execute remote commands on the underlying operating system running WS_FTP Server. A CVSS v3 base score of 10 has been calculated.
  • CVE-2023-42657 - CWE 22 - This is a directory traversal vulnerability in WS_FTP Server versions prior to 8.7.4 and 8.8.2. An attacker could exploit this vulnerability to perform file operations on files and folders outside of their authorised WS_FTP folder path. It could also allow the attacker to escape the context of the WS_FTP Server file structure and perform the same level of operations on file and folder locations on the system. A CVSS v3 base score of 9.9 has been calculated.
  • CVE-2023-40045 - CWE 79 - This is a reflected cross-site scripting (XSS) vulnerability in the WS_FTP Server's Ad Hoc Transfer module for WS_FTP Server versions prior to 8.7.4 and 8.8.2.  An attacker could exploit this vulnerability to target WS_FTP Server users with a specialized payload allowing them to execute malicious JavaScript within the victim's browser. A CVSS v3 base score of 8.3 has been calculated.
  • CVE-2023-40046 - CWE 89 - This is a SQL injection vulnerability in the WS_FTP Server manager interface for WS_FTP Server versions prior to 8.7.4 and 8.8.2. An attacker could infer information about the structure and contents of the database and execute SQL statements that edit or delete database elements. A CVSS v3 base score of 8.2 has been calculated.
  • CVE-2023-40047 - CWE 79 - This is a stored cross-site scripting (XSS) vulnerability in WS_FTP Server's Management module for WS_FTP Server versions prior to 8.8.2. An attacker with administrative privileges could exploit this vulnerability to import an SSL certificate with malicious attributes containing cross-site scripting payloads. If the payload is successfully stored, an attacker could target WS_FTP Server admins with a specialised payload which may allow the execution of malicious JavaScript within the victim's browser. A CVSS v3 base score of 8.3 has been calculated.
  • CVE-2023-40048 - CWE 352 - This is a cross-site request forgery vulnerability in POST transactions corresponding to a WS_FTP Server administrative function in WS_FTP Server versions prior to 8.8.2. A CVSS v3 base score of 6.8 has been calculated.
  • CVE-2023-40049 - CWE-200 - This vulnerability in WS_FTP Server version prior to 8.8.2, could allow an unauthenticated attacker to enumerate files under the 'WebServiceHost' directory listing. A CVSS v3 base score of 5.3 has been calculated.
  • CVE-2022-27665 - CWE-79 - This is a reflected XSS vulnerability via AngularJS sandbox escape expressions in Progress Ipswitch WS_FTP Server 8.6.0. An attacker could exploit this vulnerability to execute malicious code and commands on the client. The attacker could input malicious payloads in the subdirectory searchbar or add folder filename boxes, and execute client-side commands. A CVSS v3 base score of 6.1 has been calculated.

Previous targeting of Progress products by ransomware groups

In May 2023 Progress issued fixes for a critical vulnerability in their Managed File Transfer (MFT) software, MOVEit Transfer. Internet-facing MOVEit Transfer servers were targeted by multiple threat group - including the cybercriminal group associated with CL0P ransomware - in a mass-exploitation campaign affecting hundreds of victim organisations, resulting in major disruption and data loss.

Internet-facing file transfer applications have become a popular target for ransomware and data-extortion groups, and rapidly patching vulnerable software should be considered of critical importance.

Threat updates

Date Update
6 Oct 2023 Exploitation of CVE-2023-40044

This cyber alert has been updated to reflect this change.
3 Oct 2023 Proof-of-concept publicly released for CVE-2023-40044

This cyber alert has been updated to reflect this change.

Remediation advice

Affected organisations are required to review the Progress Community advisory WS_FTP Server Critical Vulnerability - (September 2023) article and apply updates as soon as practicable. 

CVE Vulnerabilities

Status Published

CVE-2023-40044

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Status Published

CVE-2023-42657

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
Status Published

CVE-2023-40045

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module. An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.
Status Published

CVE-2023-40046

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements.
Status Published

CVE-2023-40047

In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site scripting payloads. Once the cross-site scripting payload is successfully stored, an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victims browser.
Status Published

CVE-2023-40048

In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.
Status Published

CVE-2023-40049

In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.
Status Published

CVE-2022-27665

Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.

Last edited: 6 October 2023 9:12 am