Progress Software, known for its MOVEit file transfer software, has revealed critical vulnerabilities in another software package, and one of these vulnerabilities is already being actively exploited.
Security researchers from Assetnote, Shubham Shah and Sean Yeoh, identified CVE-2023-40044 in Progress Software’s WS_FTP package. This vulnerability impacts the entire Ad Hoc Transfer component of the software. According to Progress Software’s advisory, “In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.” However, Shah and Yeoh claimed that the vulnerability could be triggered without any authentication.
Assetnote conducted scans that uncovered nearly 3,000 internet-hosted systems meeting the conditions for exploitation. These systems were running WS_FTP and had an accessible web server. Many of these systems belonged to large enterprises, government entities, and educational institutions.
Progress Software’s advisory also disclosed other vulnerabilities, including CVE-2023-42657, which is a critical-rated directory traversal flaw enabling attackers to perform file operations like deleting and renaming files and directories on the underlying operating system.
In a statement provided to iTnews, Progress Software expressed disappointment with the rapid release of a proof-of-concept (POC) by third parties, reverse-engineered from their vulnerability disclosure and patch, which was released on September 27. This POC essentially provided cyber threat actors with a roadmap for exploiting the vulnerabilities while many of Progress Software’s customers were still in the process of applying the patch.
Progress Software clarified that they are not aware of any evidence indicating that these vulnerabilities were exploited before the POC release. They urged all WS_FTP server customers to promptly apply the patch to secure their environments against potential threats.
