WS_FTP Server - RCE (CVE-2023-40044)
Description
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
psychologyCrowdSec Analysis
CVE-2023-40044 is a critical remote code execution vulnerability in WS_FTP Server versions prior to 8.7.4 and 8.8.2, where a pre-authenticated attacker can exploit a .NET deserialization flaw in the Ad Hoc Transfer module to execute arbitrary commands on the server. This vulnerability could be leveraged for full system compromise, data theft, or further lateral movement within the network.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-40044 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending specially crafted POST requests to /aht/ahtapiservice.asmx/authuser, targeting the WS_FTP Ad Hoc API to achieve remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-09-27 |
| CISA KEV | 2023-10-05 |
| CISA Remediation Deadline | 2023-10-26 |
| Rule Released | 2023-12-15 |