CVE-2023-40044
Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability
Description
CVE-2023-40044 is a critical deserialization of untrusted data vulnerability in Progress WS_FTP Server that allows a pre-authenticated remote attacker to execute arbitrary commands on the underlying operating system. The flaw exists in the Ad Hoc Transfer module of WS_FTP Server versions prior to 8.7.4 and 8.8.2, where a .NET deserialization weakness enables remote code execution (RCE) without any authentication or user interaction. With a maximum CVSS v3.1 score of 10.0 (Critical), CVE-2023-40044 represents the most severe class of vulnerability possible. CISA has added this WS_FTP Server vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023, and ransomware operators are known to exploit it. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | ws ftp server | < 8.7.4; >= 8.8, < 8.8.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044(Third Party Advisory)
- https://censys.com/cve-2023-40044/(Third Party Advisory)
- https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023(Vendor Advisory)
- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044(Exploit, Third Party Advisory)
- https://www.progress.com/ws_ftp(Product)
- https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/(Broken Link, Third Party Advisory)
- https://www.theregister.com/2023/10/02/ws_ftp_update/(Press/Media Coverage, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-40044(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CWE-502 describes a weakness where the application deserializes untrusted data without sufficient verification that the resulting data is valid and safe. In CVE-2023-40044, the WS_FTP Server Ad Hoc Transfer module processes serialized .NET objects from untrusted input, allowing an attacker to craft malicious serialized payloads that execute arbitrary commands on the server upon deserialization.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-40044 carries the maximum CVSS v3.1 score of 10.0 (Critical severity), reflecting the most dangerous combination of exploitability and impact metrics. Attack Vector (Network): The vulnerability is remotely exploitable without physical access, making any internet-facing WS_FTP Server instance an immediate target. Attack Complexity (Low): No special conditions or preparation are required to exploit this flaw. Privileges Required (None): The attack is pre-authenticated, meaning no credentials or user account are needed. User Interaction (None): No action from any user is required. Scope (Changed): A successful exploit can affect resources beyond the WS_FTP Server application itself, extending to the underlying operating system and potentially the broader network. Confidentiality, Integrity, and Availability Impact (all High): An attacker achieving remote code execution can steal sensitive data including transferred files and credentials, modify system configurations and data, and disrupt or destroy the server entirely. The EPSS score of 94.4% confirms near-certain exploitation, and CISA has confirmed that ransomware operators are actively leveraging this vulnerability.
Exploit Maturity
Public exploit code is available for CVE-2023-40044 via Packet Storm Security and Assetnote’s detailed research, both providing proof-of-concept exploits for unauthenticated remote code execution. CISA has confirmed active exploitation in the wild and added CVE-2023-40044 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023. Ransomware usage is confirmed — threat actors have incorporated this WS_FTP Server vulnerability into ransomware attack chains. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most actively exploited flaws tracked.
Remediation
- Upgrade WS_FTP Server to a patched version immediately. Update to WS_FTP Server version 8.7.4 or later (for the 8.7.x branch) or version 8.8.2 or later (for the 8.8.x branch). The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Disable the Ad Hoc Transfer module if not required. If the Ad Hoc Transfer functionality is not essential to your operations, disable or remove the module to eliminate the attack surface entirely while planning the upgrade.
- Restrict network access to WS_FTP Server. Place WS_FTP Server behind a firewall or VPN and limit access to trusted IP addresses and networks. Block public internet access to the WS_FTP Server management and transfer interfaces.
- Audit for indicators of compromise. Review WS_FTP Server logs and IIS logs for suspicious requests targeting the Ad Hoc Transfer module. Check for unauthorized processes, new user accounts, or file system modifications on the server. Investigate any anomalous outbound network connections.
- Implement deserialization hardening as a long-term measure. Ensure that all .NET applications in your environment validate and restrict deserialized data types. Apply application-level controls such as type allowlists for deserialization operations and conduct regular security assessments of file transfer infrastructure.
Technical Details
CVE-2023-40044 exploits a .NET deserialization vulnerability in the Ad Hoc Transfer module of Progress WS_FTP Server. Attack Vector (Network): The attack is conducted remotely by sending crafted HTTP requests to the WS_FTP Server’s IIS-hosted Ad Hoc Transfer interface. Attack Complexity (Low): The attacker needs only to send a malicious serialized .NET object to a specific endpoint. The Ad Hoc Transfer module processes incoming data through IIS HTTP modules that deserialize .NET objects from user-supplied input without adequate type validation or integrity checks. An attacker can craft a serialized payload containing operating system commands that execute during the deserialization process, achieving pre-authenticated remote code execution. Scope (Changed): Because the WS_FTP Server process runs with operating system privileges, successful exploitation grants the attacker control beyond the application boundary, enabling full system compromise. The underlying weakness is classified as CWE-502 (Deserialization of Untrusted Data), where the fundamental issue is the acceptance and processing of serialized objects from untrusted sources without restricting which types can be instantiated during deserialization.
Frequently Asked Questions
Is CVE-2023-40044 being actively exploited?
Yes, CVE-2023-40044 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 26, 2023. Ransomware operators have been confirmed to use this vulnerability in their attack chains, and multiple public exploit tools are available.
What products are affected by CVE-2023-40044?
CVE-2023-40044 affects Progress WS_FTP Server versions prior to 8.7.4 (in the 8.7.x branch) and versions prior to 8.8.2 (in the 8.8.x branch). Specifically, the vulnerability exists in the Ad Hoc Transfer module of WS_FTP Server.
How do I fix CVE-2023-40044?
Upgrade WS_FTP Server to version 8.7.4 or later (for the 8.7.x branch) or version 8.8.2 or later (for the 8.8.x branch). If immediate patching is not possible, disable the Ad Hoc Transfer module and restrict network access to the WS_FTP Server. See the Remediation section above for detailed steps.
How severe is CVE-2023-40044?
CVE-2023-40044 is rated Critical with the maximum CVSS v3.1 score of 10.0 out of 10. It allows unauthenticated remote code execution with no user interaction required, and the scope extends beyond the vulnerable component to the underlying operating system. The EPSS score of 94.4% (99.99th percentile) indicates near-certain exploitation, and it has been linked to ransomware campaigns.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.