Full Report
Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild.
Analysis Summary
# Vulnerability: Progress WS_FTP Server Ad Hoc Transfer Module Flaws
## CVE Details
- **CVE ID:** CVE-2023-40044 (Primary focus), CVE-2023-42657, CVE-2023-40045, CVE-2023-40046, CVE-2023-40048, CVE-2022-27665, CVE-2023-40049.
- **CVSS Score:** 10.0 (Critical) for CVE-2023-40044; 9.9 (Critical) for CVE-2023-42657.
- **CWE:** .NET Deserialization (CVE-2023-40044); Directory Traversal (CVE-2023-42657).
## Affected Systems
- **Products:** Progress WS_FTP Server.
- **Versions:** Versions prior to 8.7.4 and 8.8.2.
- **Configurations:** Systems with the **Ad Hoc Transfer module** enabled/installed.
## Vulnerability Description
The most severe flaw, CVE-2023-40044, is a .NET deserialization vulnerability within the Ad Hoc Transfer module. It exists in the middleware layer (IIS HTTP Module). The flaw allows an unauthenticated attacker to execute arbitrary commands on the underlying operating system by sending a specially crafted request to the vulnerable endpoint.
## Exploitation
- **Status:** Exploited in the wild; Proof of Concept (PoC) is available and has been recreated by multiple security vendors.
- **Complexity:** Low (requires no authentication).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Full access to data and system).
- **Integrity:** Total (Ability to modify files and system state).
- **Availability:** Total (Ability to disrupt services or delete data).
## Remediation
### Patches
Progress has released the following fixed versions:
- **WS_FTP Server 2022.0.2 (8.8.2)**
- **WS_FTP Server 2020.0.4 (8.7.4)**
### Workarounds
The primary mitigation involves disabling or removing the Ad Hoc Transfer module if it is not strictly required for business operations, though patching is the strongly recommended course of action.
## Detection
### Indicators of Compromise (IoCs)
**Observed IP Addresses:**
- 103[.]163[.]187[.]12
- 64[.]227[.]126[.]135
- 86[.]48[.]3[.]172
- 161[.]35[.]27[.]144
- 162[.]243[.]161[.]105
**File Paths/Malware:**
- C:\Windows\TEMP\zpvmRqTOsP.exe
- C:\Windows\TEMP\ZzPtgYwodVf.exe
### Detection Methods
- **Process Monitoring:** Look for suspicious child processes spawned by the IIS worker process (**w3wp.exe**).
- **Command Line Logs:** Monitor for unusual PowerShell syntax or `certutil` commands (e.g., using `certutil -urlcache -f` to download executables to `\TEMP\`).
## References
- **Vendor Advisory:** [https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023](https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023)
- **Huntress Analysis:** [https://www.huntress.com/blog/critical-vulnerabilities-ws-ftp-exploitation](https://www.huntress.com/blog/critical-vulnerabilities-ws-ftp-exploitation)
- **CVE Record:** [https://www.cve.org/CVERecord?id=CVE-2023-40044](https://www.cve.org/CVERecord?id=CVE-2023-40044)