Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

CheckOps priority index

9.7/10 Patch within 24 h

Severity10.0

Probability9.0

Exploitation5/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 90.4% higher than 99.8% of CVEs

CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:

Exploited for 1,125 days 05 Oct 2023

CISA due date 26 Oct 2023 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 5 / 5

KEV catalog (CISA)05 Oct 2023
Exploited in EUVD (ENISA)05 Oct 2023
Used by ransomwareyes
EPSS above 10 %90.4%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Affected products

WS_FTP Server

Affected versions

8.8.0 <8.8.2
8.7.0 <8.7.4

Weaknesses (CWE)

CWE-502

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

27 Sept 2023
Published
05 Oct 2023
Exploitation reported (ENISA)
05 Oct 2023
Added to the KEV catalog
26 Oct 2023
CISA remediation due date
28 Sept 2026
EPSS peak: 90.6%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-8037Progress LoadMaster Command Injection Vulnerability
8.6 · Actively exploited
CVE-2024-4885Progress WhatsUp Gold Path Traversal Vulnerability
9.3 · Background exploitation
CVE-2024-1212Progress Kemp LoadMaster OS Command Injection Vulnerability
9.3 · Background exploitation
CVE-2024-6670Progress WhatsUp Gold SQL Injection Vulnerability
9.7 · Background exploitation
CVE-2024-4358Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
9.2 · Background exploitation
CVE-2023-34362Progress MOVEit Transfer SQL Injection Vulnerability
9.9 · Background exploitation