Move Over, MOVEit: WS_FTP Software Faces a Critical Progress Bug

Recent Vulnerabilities in Progress Software‘s File-Transfer Products Raise Concerns

Introduction

Once again, Progress Software‘s enterprise security teams are facing the urgent task of protecting organizations against critical vulnerabilities in their file-transfer software. This time, the vulnerabilities affect the widely used WS_FTP file transfer product, which is utilized by approximately 40 million people. The most severe of these bugs allows for pre-authenticated remote code execution (RCE) without any user interaction. Additionally, there is another bug classified as near maximum severity and six others of high or medium severity. The disclosure of these vulnerabilities comes just months after the company disclosed a zero-day vulnerability in its MOVEit file transfer technology, which has already affected over 2,100 organizations, many of them falling victim to ransomware attacks from the Cl0p group. The new vulnerabilities pose a similar threat, as they affect all supported versions of WS_FTP, which, like MOVEit, is enterprise-grade software used for secure file transfers between systems, groups, and individuals.

The Remediation Process and Urgent Patching

Progress Software has taken prompt action and remediated the vulnerabilities by issuing version-specific hotfixes for all affected products. Customers are strongly urged to update immediately or apply the recommended mitigation steps. Organizations using unsupported versions of WS_FTP are advised to upgrade to a supported and fixed version as soon as possible. Progress emphasizes that “upgrading to a patched release, using the full installer, is the only way to remediate this issue,” but warns that there will be an outage during the upgrade.

Details of the Vulnerabilities

The vulnerabilities disclosed by Progress affect the WS_FTP Server Ad hoc Transfer Module and the WS_FTP Server manager interface. The most critical vulnerability, tracked as CVE-2023-40044, allows attackers to gain pre-authentication RCE on affected systems. This vulnerability is a .NET serialization vulnerability, a common type of bug where an application processes request payloads in an insecure manner. These flaws can lead to denial-of-service attacks, information leaks, and remote code execution. Another critical bug, CVE-2023-42657, is a directory traversal vulnerability that affects WS_FTP Server versions prior to 8.7.4 and 8.8.2. Exploiting this vulnerability enables attackers to perform unauthorized file operations outside of authorized WS_FTP folder paths and even on the underlying operating system itself.

Other Vulnerabilities and Potential Exploitation

In addition to the critical vulnerabilities, there are also two high-severity vulnerabilities categorized as cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow for the execution of malicious JavaScript. The remaining vulnerabilities are of medium severity and include a cross-site request forgery (CSRF) bug and an information disclosure issue, among others.

Advice for Organizations

Given the severity of the vulnerabilities and the potential for exploitation, organizations using WS_FTP are strongly advised to take immediate action. Rapid7 has verified the ease of exploitability of the most severe vulnerability, emphasizing the need for prompt patching. Organizations that maintain a good software inventory or have programs to monitor software use in their environment should have a relatively easy time tracking down and updating vulnerable instances of WS_FTP. Software inventory tools can scan the environment for installed apps and running services, while file searches can be used as a secondary method to identify and update versions of WS_FTP at rest. Additionally, network monitoring tools can be employed to detect any incoming connection requests on the related incoming ports, which are typically open when running versions of WS_FTP.

Conclusion

The recent vulnerabilities discovered in Progress Software‘s file-transfer products, particularly the critical vulnerabilities in the WS_FTP file transfer software, have raised concerns among security professionals and organizations alike. The urgency of patching and mitigating these vulnerabilities cannot be overstated, given the potential for remote code execution and other malicious activities. Organizations must prioritize the immediate update or upgrade of their WS_FTP installations to protect against these vulnerabilities. Moreover, it is crucial for organizations to maintain robust software inventory systems and utilize network monitoring tools to detect and prevent future security incidents. The timely response and mitigation of these vulnerabilities will be key in safeguarding sensitive enterprise data and information.