Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-27665 | Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. NVD description · AI analysis pending | 6.1 | 33% | PoC |
| — | |
| CVE-2023-40044 | Unauthenticated Deserialization RCE in Progress WS_FTP Server CVE-2023-40044 is a .NET deserialization-of-untrusted-data flaw (CWE-502) in the Ad Hoc Transfer module of Progress WS_FTP Server. A remote attacker can trigger it by sending maliciously crafted input to that module before authentication, and successful exploitation yields arbitrary command execution on the underlying WS_FTP Server operating system. Any organization running WS_FTP Server versions prior to 8.7.4 or 8.8.2 is affected, with internet-facing file-transfer servers the most exposed. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2023-10-05 with known ransomware use, public proof-of-concept exploits are available, and EPSS assigns a ~90% probability of exploitation within 30 days. Headlines indicate ransomware operators are actively targeting unpatched WS_FTP servers, making this a priority patch. Do: Upgrade WS_FTP Server to 8.7.4 or 8.8.2 (or later) per Progress's hotfix guidance; per CISA's KEV required action, apply vendor mitigations or discontinue use if patching is unavailable. If patching cannot be done immediately, restrict or disable the Ad Hoc Transfer module and limit internet exposure of WS_FTP servers. Given confirmed ransomware use, prioritize internet-facing instances and review server and OS logs for signs of compromise or post-exploitation activity. | 8.8 | 90% | KEV ransomware PoC ×2 |
| large≈10,000+ internet-exposed WS_FTP servers (public scan data at disclosure time), with the total enterprise installed base likely several times larger | |
| CVE-2023-42657 | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered. An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path. Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system. NVD description · AI analysis pending | 9.6 group max | 17% |
| — |
Full article794 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 29, 2023Server Security / Vulnerability
Progress Software has released hotfixes for a critical security vulnerability, alongside seven other flaws, in the WS_FTP Server Ad hoc Transfer Module and in the WS_FTP Server manager interface.
Tracked as CVE-2023-40044, the flaw has a CVSS score of 10.0, indicating maximum severity. All versions of the software are impacted by the flaw.
"In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system," the company said in an advisory.
Assetnote security researchers Shubham Shah and Sean Yeoh have been credited with discovering and reporting the vulnerability.
The list of remaining flaws, impacting WS_FTP Server versions prior to 8.8.2, is as follows -
- CVE-2023-42657 (CVSS score: 9.9) - A directory traversal vulnerability that could be exploited to perform file operations.
- CVE-2023-40045 (CVSS score: 8.3) - A reflected cross-site scripting (XSS) vulnerability in the WS_FTP Server's Ad Hoc Transfer module that could be exploited to execute arbitrary JavaScript within the context of the victim's browser.
- CVE-2023-40047 (CVSS score: 8.3) - A stored cross-site scripting (XSS) vulnerability exists in the WS_FTP Server's Management module that could be exploited by an attacker with admin privileges to import an SSL certificate with malicious attributes containing XSS payloads that could then be triggered in victim's browser.
- CVE-2023-40046 (CVSS score: 8.2) - An SQL injection vulnerability in the WS_FTP Server manager interface that could be exploited to infer information stored in the database and execute SQL statements that alter or delete its contents.
- CVE-2023-40048 (CVSS score: 6.8) - A cross-site request forgery (CSRF) vulnerability in the WS_FTP Server Manager interface.
- CVE-2022-27665 (CVSS score: 6.1) - A reflected cross-site scripting (XSS) vulnerability in Progress Ipswitch WS_FTP Server 8.6.0 that can lead to execution of malicious code and commands on the client.
- CVE-2023-40049 (CVSS score: 5.3) - An authentication bypass vulnerability that allows users to enumerate files under the 'WebServiceHost' directory listing.
With security flaws in Progress Software becoming an attractive target for ransomware groups like Cl0p, it's essential that users move quickly to apply the latest patches to contain potential threats.
The company, in the meanwhile, is still grappling with the fallout from the mass hack targeting its MOVEit Transfer secure file transfer platform since May 2023. More than 2,100 organizations and over 62 million individuals are estimated to have been impacted, according to Emsisoft.
Update
Cybersecurity firm Rapid7 said it has observed "multiple instances of WS_FTP exploitation in the wild" as part of what it said is likely an opportunistic campaign, making it imperative that users move quickly to apply the fixes.
"This vulnerability turned out to be relatively straightforward and represented a typical .NET deserialization issue that led to RCE," Assetnote said in an advisory for CVE-2023-40044. "It's surprising that this bug has stayed alive for so long, with the vendor stating that most versions of WS_FTP are vulnerable."
Huntress Labs, in an advisory, said it has detected in-the-wild exploitation in a very small number of cases, indicating that the activity so far are mostly opportunistic in nature, with threat actors casting a wide net to breach vulnerable instances.
"CVE-2023-40044 is a.NET deserialization vulnerability in the Ad Hoc Transfer module of WS_FTP," Tenable researcher Satnam Narang said. "An unauthenticated (or pre-authenticated) attacker could exploit this vulnerability by sending a specially crafted POST request to a vulnerable WS_FTP Server."
However, attack surface management vendor Censys pointed out that "the number of potentially vulnerable servers is much lower than expected, which is not the worst news."
Statement from Progress spokesperson:
“We are disappointed in how quickly third parties released a proof of concept (POC), reverse-engineered from our vulnerability disclosure and patch, released on Sept. 27. This provided threat actors a roadmap on how to exploit the vulnerabilities while many of our customers were still in the process of applying the patch. We are not aware of any evidence that these vulnerabilities were being exploited prior to that release. Unfortunately, by building and releasing a POC rapidly after our patch was released, a third-party has given cyber criminals a tool to attempt attacks against our customers. We are encouraging all WS_FTP server customers to patch their environments as quickly as possible.
"The security of our customers is our top priority and we continue to work with our customers and responsible third-party research experts to discover, properly disclose and remediate any issues. We hope that the community will discourage the irresponsible publication of POCs rapidly following the release of security patches from software vendors.”
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/progress-software-releases-urgent.html