The WS_FTP team recently discovered vulnerabilities in the WS_FTP Server Ad hoc Transfer Module and in the WS_FTP Server manager interface. All versions of WS_FTP Server are affected by these vulnerabilities. We have addressed these issues and have made version-specific hotfixes available for customers to remediate them.  

If your version is no longer supported as part of the WS_FTP Product Lifecycle , you should upgrade to a supported and fixed version.
 

CVE-2023-40044 (CRITICAL)
CVSS: 10
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.   

Discoverer Credit: Shubham Shah – Assetnote, Sean Yeoh – Assetnote 

Affects
All versions of WS_FTP Server Ad hoc module are affected by this vulnerability.  

Remedial Steps

If you are unable to update immediately, this can be mitigated by following the steps in the article below. Please note you only need to follow this if you have the Ad Hoc Module installed.

https://community.progress.com/s/article/Removing-or-Disabling-the-WS-FTP-Server-Ad-hoc-Transfer-Module
 

CVE-2023-42657 (CRITICAL)
CVSS: 9.9 
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this vulnerability to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder path.  Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system.
 

CVE-2023-40045 (HIGH) 
CVSS: 8.3
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module.  An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload which results in the execution of malicious JavaScript within the context of the victim's browser.  

Discoverer Credit: Cristian Mocanu – Deloitte  
 

CVE-2023-40046 (HIGH) 
CVSS: 8.2
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. 

 

CVE-2023-40047 (HIGH) 
CVSS: 8.3
In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import an SSL certificate with malicious attributes containing cross-site scripting payloads.  Once the cross-site scripting payload is successfully stored, an attacker could leverage this vulnerability to target WS_FTP Server admins with a specialized payload which results in the execution of malicious JavaScript within the context of the victim's browser.   

Discoverer Credit: Cristian Mocanu – Deloitte 
 

CVE-2023-40048 (MEDIUM) 
CVSS: 6.8 
In WS_FTP Server version prior to 8.8.2, the WS_FTP Server Manager interface was missing cross-site request forgery (CSRF) protection on a POST transaction corresponding to a WS_FTP Server administrative function.  

Discoverer Credit: Cristian Mocanu – Deloitte 
 

CVE-2022-27665 (MEDIUM) 
CVSS: 6.1 
Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI. 
Discoverer Credit: HackerOne - dievus, HackerOne - rondons
 

CVE-2023-40049 (MEDIUM) 
CVSS: 5.3 
In WS_FTP Server version prior to 8.8.2, an unauthenticated user could enumerate files under the 'WebServiceHost' directory listing.  

Discoverer Credit: Cristian Mocanu – Deloitte 

Solution
We have addressed the vulnerabilities above and the Progress WS_FTP team strongly recommends performing an upgrade to one of the fixed version listed below.  We do recommend upgrading to the most highest version which is 8.8.2.
 

PLEASE NOTE: Upgrading to a patched release, using the full installer, is the only way to remediate this issue. There will be an outage to the system while the upgrade is running.

For all customers on a current maintenance agreement, the upgrade can be accessed by logging into the Progress Community - https://community.progress.com/s/, or by clicking on one of the links below.  Customers that are not on a current maintenance agreement should contact the Progress Renewals team or your Progress partner account representative. 

To confirm your current version of WS_FTP Server please follow the instructions in this knowledge base article

To obtain the appropriate installer, please perform the following:  

1. Log in to the Download Center at https://community.progress.com/s/products-list using your Progress ID credentials  
   
2. Select the appropriate Asset from the list  
  
3. Click the Download link under the Related Products & Downloads section  
  
4. Click [Download] next to the Fixed Version you would like to download (reference table below) 

 

Fixed Version	Documentation	Release Notes
WS_FTP Server 2020.0.5 (8.7.5)	Upgrade Documentation	WS_FTP Server 2020
WS_FTP Server 2022.0.3 (8.8.3)	Upgrade Documentation	WS_FTP Server 2022

Indicators of Compromise
If you do notice any of the indicators of compromise (IoCs) described in the link below, please contact your security and IT teams immediately:

https://www.huntress.com/blog/critical-vulnerabilities-ws_ftp-exploitation

Threat Actors Actively Exploiting Progress WS_FTP via Multiple Attack Chains

If you have any questions, concerns, or problems related to this issue, please login to open a new Technical Support case in our customer community for assistance. Technical Support is available to WS_FTP Server customers under warranty and active maintenance.

Sincerely,
The Progress WS_FTP Team

To receive email notifications for Product Hotfixes and Security Hotfixes like this, please log into the Progress Community Portal and sign up for our Progress Alert and Notification Service (PANS). Please see our page regarding Frequently Asked Questions (FAQ) for Progress Alert Notifications (PANS).