Attackers Actively Exploiting WS_FTP Vulnerabilities

Warnings are being sounded to large enterprises, including government and educational organizations, to immediately update widely used FTP software amidst active attacks.

See Also: Live Webinar | Cyber Resilience: Recovering from a Ransomware Attack

Multiple exploitable flaws exist in numerous versions of WS_FTP Server, built by Progress Software. One of the most serious is present “in WS_FTP Server versions prior to 8.7.4 and 8.8.2,” for which “the Ad Hoc Transfer module is vulnerable to a .NET deserialization vulnerability that allows an unauthenticated attacker to execute remote commands on the underlying WS_FTP Server operating system,” security firm Rapid7 said. “The vulnerability affects all versions of the WS_FTP Server Ad Hoc module.”

Progress Software patched eight flaws by releasing versions 8.7.4 and 8.8.2 of the software, and recommends all users update to the latter if possible. “Upgrading to a patched release, using the full installer, is the only way to remediate this issue,” the Burlington, Massachusetts-based vendor said in a Wednesday security alert. “There will be an outage to the system while the upgrade is running.”

The updates include a patch for the .NET deserialization vulnerability, designated CVE-2023-40044, via which attackers can remotely execute arbitrary code. Progress Software credited discovery of that flaw to security researchers Shubham Shah and Sean Yeoh at Australian cybersecurity firm AssetNote.

“We found that there are about 2,900 hosts on the internet that are running WS_FTP and also have their webserver exposed, which is necessary for exploitation,” AssetNote said in a Saturday blog post. “Most of these online assets belong to large enterprises, governments and educational institutions.”

The .NET deserialization flaw – CVE-2023-40044 – “is trivially exploitable and allows an unauthenticated attacker to achieve remote code execution on the target system,” Caitlin Condon, head of vulnerability research at Rapid7, told Information Security Media Group.

“We discovered that the vulnerability could be triggered without any authentication, and it affected the entire Ad Hoc Transfer component of WS_FTP,” AssetNote said. “It was a bit shocking that we were able to reach the deserialization sink without any authentication,” allowing for arbitrary code exploitation.

Proof-of-concept code for exploiting CVE-2023-40044 became public Friday, Rapid7 said. By Saturday, the firm reported seeing “what appears to be exploitation of one or more recently disclosed WS_FTP vulnerabilities in multiple customer environments.” Since Sunday, it’s been tracking a second campaign targeting one or more of the WS_FTP vulnerabilities, reporting that attempted “mass exploitation” of the flaws might already be well underway.

The U.S. Health Sector Cybersecurity Coordination Center, or HC3, in a Friday alert, said it “strongly encourages all users to follow the manufacturer’s recommendation and upgrade to the highest version available – 8.8.2 – to prevent any damage from occurring.”

“If you are using the Ad Hoc Transfer module in WS_FTP Server and are not able to update to a fixed version, consider disabling or removing the module,” Rapid7’s Condon said. Her firm has also updated its Velociraptor open source security monitoring software tool’s library with a forensic artifact that allows users to review Microsoft Internet Information Services server logs for signs of exploitation.

Disabling the Ad Hoc Transfer module won’t mitigate the seven other vulnerabilities patched via the latest versions of WS_FTP Server. Another critical flaw is CVE-2023-4265, a directory traversal vulnerability. “If successfully exploited, an attacker could leverage this to perform file operations – delete, rename, rmdir, mkdir – on files and folders that are outside of the authorized WS_FTP path,” HC3 said. “Additionally, the attacker could escape the WS_FTP server file structure and perform the same operations on the operating system.”

Target: Secure File-Transfer Software

Software used to securely transfer files continues to be a top target for extortionists. AssetNote said it found the vulnerabilities in WS_FTP after proactively reviewing a client’s attack surface in light of such attacks.

The Clop – aka Cl0p – ransomware group in particular continues to find and exploit vulnerabilities in widely used file-transfer software, starting with Accellion’s legacy File Transfer Appliance software in 2021 (see: Accellion Agrees to $8.1 Million Breach Settlement).

Since then, Clop has launched similar campaigns targeting SolarWinds Serv-U, Fortra’s GoAnywhere MFT and more recently MOVEit, made by WS_FTP developer Progress Software (see: Data Breach Toll Tied to Clop Group’s MOVEit Attack Surges).

Earlier this year, Dylan Pindur of AssetNote reported a critical vulnerability in Citrix ShareFile, a cloud-based secure file sharing and transfer services also known as Citrix Content Collaboration, to the vendor. Citrix pushed a patch for the flaw – CVE-2023-24489 – in May, initially restricting access using a customer-only portal, via which 83% of users updated their software before the vendor made it public in June, Bleeping Computer reported.

By August, the U.S. Cybersecurity and Infrastructure Security Agency warned that the Citrix ShareFile vulnerability was being actively exploited by attackers.

Security experts have warned all organizations that use secure file-transfer tools to review their documentation to identify how such software can be locked down. Encrypting data, using strong access controls and leaving files on such systems for as little time as possible are just some of the cyber hygiene practices organizations should follow, Teresa Walsh, chief intelligence officer at FS-ISAC, which is the financial services industry’s information sharing and analysis center, recently told ISMG (see: Lessons to Learn From Clop’s MOVEit Supply Chain Attacks).