Progress · WS_FTP Server
CVE-2023-40044
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
What it is
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
CISA: Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 26, 2023
- Added to the CISA list
- October 5, 2023
- Published
- September 27, 2023
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 90% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-502
- More details
- NVD · CVE.org · CISA
All references (8)
- https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
- https://www.progress.com/ws_ftp
- https://www.theregister.com/2023/10/02/ws_ftp_update/
- https://www.rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server/
- https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044
- https://censys.com/cve-2023-40044/
- https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
- http://packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.ht…
More exploited flaws from Progress
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 7, 2026 | Command Injection | LoadMaster | Critical 9.6 | 99.8% |
| Mar 3, 2025 | Path Traversal | WhatsUp Gold | Critical 9.8 | 99.3% |
| Nov 18, 2024 | OS Command Injection | Kemp LoadMaster | Critical 10.0 | 95% |
| Sep 16, 2024 | SQL Injection | WhatsUp Gold | Critical 9.8 | 93% |
| Jun 13, 2024 | Authentication Bypass by Spoofing | Telerik Report Server | Critical 9.8 | 97% |
| Jun 2, 2023 | SQL Injection | MOVEit Transfer | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness | ASP.NET AJAX and Sitefinity | Critical 9.8 | 75% |
| Nov 3, 2021 | Deserialization of Untrusted Data | Telerik UI for ASP.NET AJAX | Critical 9.8 | 99.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.