Progress Software, known for its MOVEit file transfer software that was previously associated with cyberattacks, has disclosed critical vulnerabilities in another package, WS_FTP. Security researchers from Assetnote identified these vulnerabilities, with one of them already being exploited.
The vulnerabilities could potentially allow attackers to execute remote commands and perform file operations on the affected systems.
Key Points
Vulnerability Details: Researchers from Assetnote discovered a deserialization vulnerability in Progress Software’s WS_FTP package, specifically affecting the entire Ad Hoc Transfer component. This vulnerability is tracked as CVE-2023-40044.
Exploitation Without Authentication: While Progress Software initially mentioned that the vulnerability required pre-authentication, the researchers from Assetnote claimed that it could be triggered without any authentication, making it potentially more dangerous.
Scope of Exploitation: Assetnote conducted scans and identified nearly 3,000 internet hosts that met the conditions for exploitation. These hosts were running WS_FTP and had accessible web servers. Many of these hosts belonged to large enterprises, governments, and educational institutions.
Additional Vulnerabilities: Progress Software disclosed other vulnerabilities in its advisory, including CVE-2023-42657, a critical-rated directory traversal vulnerability. This flaw could enable attackers to perform various file operations on the underlying operating system, including deleting and renaming files and directories.
Progress Software has revealed critical vulnerabilities in its WS_FTP package, including a deserialization vulnerability that could be exploited without authentication. Researchers have already identified numerous vulnerable hosts on the internet, including those belonging to large organizations.
Progress Software also disclosed other security issues in its advisory, highlighting the importance of prompt patching and mitigation efforts to secure affected systems.