Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

概要

参考情報

• packetstormsecurity.com/files/174917/Progress-Software-WS_FTP-Unauthenticated-Remote-Code-Execution.html · Exploit
• attackerkb.com/topics/bn32f9sNax/cve-2023-40044 · Third Party Advisory
• censys.com/cve-2023-40044 · Third Party Advisory
• community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 · Vendor Advisory
• assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044 · Exploit
• progress.com/ws_ftp · Product
• rapid7.com/blog/post/2023/09/29/etr-critical-vulnerabilities-in-ws_ftp-server · Broken Link
• theregister.com/2023/10/02/ws_ftp_update · Press/Media Coverage
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2023-40044

ws ftp server のその他の脆弱性

• CVE-2024-7745高 8.1In WS_FTP Server versions before 8.8.8 (2022.0.8), a Missing Critical Step in Multi-Factor Authentication of the Web Transfer Module allows …
• CVE-2024-7744中 6.5In WS_FTP Server versions before 8.8.8 (2022.0.8), an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnera…
• CVE-2024-1474中 6.1In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS…
• CVE-2023-42659高 8.8 In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer…
• CVE-2023-42657緊急 9.6 In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a directory traversal vulnerability was discovered.  An attacker could leverage this …