Full Report
Huntress discovered active exploitation of Wing FTP Server RCE (CVE-2025-47812). Learn more about the injection flaw, attack timeline, forensic artifacts, and how to protect your organization.
Analysis Summary
# Vulnerability: Wing FTP Server Null Byte Lua Injection RCE
## CVE Details
- **CVE ID**: CVE-2025-47812
- **CVSS Score**: Not explicitly listed in text, but categorized as Root/SYSTEM-level Remote Code Execution (RCE)
- **CWE**: CWE-94 (Improper Control of Generation of Code / Injection), CWE-159 (Null Byte Injection)
## Affected Systems
- **Products**: Wing FTP Server (Windows, Linux, and macOS versions)
- **Versions**: All versions prior to 7.4.4
- **Configurations**:
- Requires an account with known credentials OR
- Requires "Anonymous" login to be enabled (allowing access without a password).
## Vulnerability Description
The flaw resides in how the `loginok.html` file handles the authentication process, specifically the `username` parameter. The application fails to properly sanitize null bytes (`%00`). An attacker can inject a null byte into the username to break string processing, followed by malicious Lua syntax (e.g., `]]` to close existing structures and newlines to inject new code).
When the server subsequently deserializes the session object file (triggered by visiting other pages like `dir.html`), the injected Lua code is executed. Because the service typically runs with high privileges, this leads to RCE as root or SYSTEM.
## Exploitation
- **Status**: Exploited in the wild (First observed July 1, 2025).
- **Complexity**: Low (Public PoC and technical write-ups are available).
- **Attack Vector**: Network (Remote).
## Impact
- **Confidentiality**: High (Full system access).
- **Integrity**: High (Ability to modify system files and session data).
- **Availability**: High (Ability to disrupt services or execute arbitrary commands).
## Remediation
### Patches
- **Update to Wing FTP Server version 7.4.4** or later immediately.
### Workarounds
- Disable "Anonymous" login if not required to reduce the attack surface.
- Restrict access to the web administration and file transfer interfaces to trusted IP addresses only.
## Detection
- **Indicators of Compromise (IoCs)**:
- **Log Analysis**: Check logs in `C:\Program Files (x86)\Wing FTP Server\Log\Domain\[DomainName]\`. Look for `YYYY-M-D.log` files containing unexpected Lua syntax characters (`]]`, `--`) or null bytes in the username field.
- **Process Monitoring**: Unusual child processes spawned by `WFTPServer.exe`.
- **Forensic Artifacts**: Examination of session object files for injected Lua code blocks.
## References
- Vendor Site: hxxps[://]www[.]wftpserver[.]com/
- RCE Security Technical Write-up: hxxps[://]www[.]rcesecurity[.]com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
- Huntress Blog: hxxps[://]www[.]huntress[.]com/blog/wing-ftp-server-remote-code-execution-cve-2025-47812-exploited-in-wild