Exploitation of Critical WS_FTP Bug Remains Minimal: A Double-Edged Sword

Attack Targeting Flaw in WS_FTP Server File Transfer Product Limited, But Organizations Urged to Patch Vulnerability

After a recent disclosure by Progress Software regarding a maximum-severity flaw in its WS_FTP Server file transfer product, attacks targeting the vulnerability have been limited. However, experts warn that organizations should not delay in patching the vulnerability, considering the extent of exploitation seen in a similar flaw reported by Progress earlier this year.

The Details of the Vulnerability

The bug, identified as CVE-2023-40044, is a .NET deserialization vulnerability in WS_FTP. Researchers have demonstrated that an unauthenticated attacker can exploit the vulnerability by using a single HTTPS POST request with specific multi-part data. The flaw affects all supported versions of the software and has a maximum possible severity score of 10.0 on the CVSS scale, as it allows an attacker to run remote commands on the server’s underlying operating system.

Exploit Activity and Proof-of-Concepts

Proof-of-concept exploit code for the vulnerability was made available soon after its disclosure by Assetnote, the company that reported the flaw to Progress, and others. This led to some early exploit activity targeting the vulnerability. Rapid7, a security vendor, reported observing exploitation of the WS_FTP vulnerabilities in multiple customer environments, indicating mass exploitation. Rapid7 also theorized that a single actor was likely behind the attacks based on their similarity.

In their technical analysis, Rapid7 provided a detailed description of CVE-2023-40044 and how it can be exploited. Caitlin Condon, head of vulnerability research at Rapid7, stated that multiple instances of WS_FTP Server exploitation were observed on September 30th, but all incidents have been contained. While Rapid7 could not link the attacks to any particular vulnerability, it is likely that at least some of the activity targeted CVE-2023-40044.

Huntress Labs, another security firm, reported observing a limited number of attacks targeting CVE-2023-40044 and other WS_FTP flaws. The attacks were opportunistic in nature and indicative of attackers casting a wide net to exploit vulnerable WS_FTP servers. Notably, these servers were primarily used by financial institutions and healthcare providers, based on the observations made by Huntress.

Number of Vulnerable Servers

Censys, an internet monitoring firm, conducted a search for vulnerable WS_FTP servers and found that the number was substantially lower than initially assumed. Of the 4,000 Internet-accessible WS_FTP hosts, only 325 had the Ad Hoc Transfer Module enabled. Furthermore, by September 29th, 91 hosts had disabled the service. Comparatively, there are still several thousand instances of systems exposed to the previously reported MOVEit vulnerability.

Progress Software’s Response

Progress Software expressed disappointment in how quickly third parties had released proof-of-concepts for the vulnerabilities disclosed last week. The company stated that this provided threat actors with a roadmap to exploit the vulnerabilities while customers were still in the process of applying the patch. However, Progress Software has no evidence to suggest that these vulnerabilities were being exploited prior to their disclosure.

Analysis and Editorial

The limited exploitation of the WS_FTP Server file transfer product vulnerability is a positive sign, but it is crucial for organizations to patch the flaw as soon as possible. The severity and ease of exploitability of CVE-2023-40044 make it attractive for attackers seeking to gain unauthorized access to servers. The fact that a single HTTPS POST request can be used to execute remote commands highlights the potential danger.

The quick availability of proof-of-concept exploit code for the vulnerability is a concern. It exposes a challenge for software companies like Progress Software, as it gives attackers a head start in developing their own exploits before official patches can be applied. Software vendors must work closely with researchers to responsibly disclose vulnerabilities and provide patches promptly to minimize the risk of exploitation.

The relatively low number of vulnerable servers is a positive factor in containing the impact of the vulnerability. The efforts made by organizations to disable the Ad Hoc Transfer Module and the presence of fewer WS_FTP servers compared to MOVEit servers are encouraging signs. However, organizations should not rely solely on this information to determine the urgency of patching. The potential consequences of a successful attack on WS_FTP servers warrant immediate action.

Advice for Organizations

Given the severity of CVE-2023-40044 and the potential risk it poses, organizations using WS_FTP Server file transfer product should take the following steps:

1. Apply the Patch

Organizations should immediately apply the patch provided by Progress Software to mitigate the vulnerability. Prompt patching can greatly reduce the chances of successful exploitation.

2. Security Awareness and Training

Enhance security awareness among employees, particularly those responsible for managing and monitoring WS_FTP servers. Training should focus on recognizing and mitigating phishing attacks, as well as best practices for secure server configuration.

3. Regular Vulnerability Scanning

Conduct regular vulnerability scans and penetration tests on WS_FTP servers to identify any potential security weaknesses. This will allow organizations to proactively address vulnerabilities and apply patches promptly.

4. Access Controls and Monitoring

Implement strict access controls on WS_FTP servers, limiting permissions to only authorized users and necessary functionality. Regularly monitor server logs and network traffic for any suspicious activity that may indicate an ongoing attack.

5. Develop Incident Response Plan

Create an incident response plan that outlines the necessary steps to be taken in the event of a successful attack. This plan should include clear guidelines for isolating affected servers, notifying relevant stakeholders, and restoring services securely.

By following these steps, organizations can significantly reduce the risk of exploitation and protect their WS_FTP servers from potential unauthorized access and data breaches.