Advisories

Wing FTP Server - Authenticated RCE

Go Back
severity
high
date
Affecting
  • Wing FTP Server 4.3.8

CWE
  • CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS
8.6
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
notcos
Description
Wing FTP Server versions 4.3.8 and below contain an authenticated remote code execution vulnerability that allows attackers to execute arbitrary PowerShell commands through the admin interface. Attackers can leverage a crafted Lua script payload with base64-encoded PowerShell to establish a reverse TCP shell by authenticating and sending a malicious request to the admin panel.