Critical Vulnerability Discovered in Wing FTP Server

What changed

Wing FTP Server has been found to have a significant security flaw related to the improper neutralization of null byte characters. This vulnerability, present in versions prior to 7.4.4, affects both user and admin web interfaces, enabling the injection of arbitrary Lua code into user session files.

The implications of this vulnerability are severe, as it allows attackers to execute arbitrary system commands with the privileges of the FTP service, potentially leading to complete server compromise.

Who is affected

Various users and organizations utilizing Wing FTP Server are at risk due to this vulnerability. Here are some of the affected groups:

The flaw is particularly concerning as it can be exploited through anonymous FTP accounts, increasing the risk for unprotected servers.

• Users of Wing FTP Server versions prior to 7.4.4
• Organizations relying on FTP services for file transfers
• Administrators managing FTP servers without recent updates
• Any entity using anonymous FTP accounts on vulnerable servers

What to do

To mitigate the risks associated with this vulnerability, it is crucial for users to take immediate action. Updating to the latest version of Wing FTP Server is highly recommended to ensure protection against this exploit.

Additionally, reviewing security configurations and limiting the use of anonymous FTP accounts can further reduce exposure to potential attacks.

• Upgrade to Wing FTP Server version 7.4.4 or later
• Disable anonymous FTP access if not needed
• Regularly review and update server security configurations
• Monitor server logs for any suspicious activities