Critical Remote Code Execution Vulnerability in Wing FTP Server

What changed

Wing FTP Server versions before 7.4.4 are affected by a vulnerability that improperly neutralizes null byte characters ('\0'). This flaw can lead to the injection of arbitrary Lua code into user session files.

The consequence of this vulnerability is significant, as it allows attackers to execute arbitrary system commands with the privileges of the FTP service, which could lead to complete server compromise.

Who is affected

Organizations using Wing FTP Server versions prior to 7.4.4 are at risk. This includes both user and admin web interfaces that mishandle null byte characters.

The vulnerability is particularly concerning as it can be exploited through anonymous FTP accounts, increasing the attack surface.

• Wing FTP Server users and administrators
• Organizations relying on FTP services for file transfers
• Any entity using versions before 7.4.4

What to do

Immediate action is required to mitigate the risk associated with this vulnerability. Users should upgrade to Wing FTP Server version 7.4.4 or later to close this security gap.

Additionally, review FTP access controls and monitor for any unusual activity that may indicate exploitation attempts.

• Upgrade to Wing FTP Server version 7.4.4 or later
• Implement strict access controls for FTP accounts
• Monitor server logs for suspicious activity