This remote code execution (RCE) flaw exploits improper NULL byte handling in the server’s authentication mechanism, enabling attackers to inject arbitrary Lua code and execute system commands with elevated privileges. Additionally, organizations should review their FTP server configurations and consider implementing network-level protections such as firewalls and intrusion detection systems to monitor for exploitation attempts targeting this vulnerability. The injected code can execute arbitrary operating system commands, including id in this example, which returns user information on Unix-like systems. The vulnerability’s impact is particularly severe because Wing FTP Server typically runs with elevated privileges, as root on Linux systems and NT AUTHORITY/SYSTEM on Windows platforms. CVE-2025-47812, critical RCE vulnerability in Wing FTP Server ≤7.4.3 via NULL byte injection in /loginok.html endpoint. The exploit mechanism leverages the server’s Lua scripting engine, which Wing FTP Server uses internally for various operations. The attack vector is especially dangerous for servers configured to allow anonymous FTP access, as it provides a completely unauthenticated path to system compromise.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Jul 2025 09:25:22 +0000