CVE-2020-37032
📋 TL;DR
CVE-2020-37032 is a remote code execution vulnerability in Wing FTP Server's Lua-based web console that allows authenticated attackers to execute arbitrary system commands via the os.execute() function. This affects organizations running vulnerable versions of Wing FTP Server with web console access enabled. Attackers can gain full control of the server if they obtain valid credentials.
💻 Affected Systems
- Wing FTP Server
📦 What is this software?
Wing Ftp Server by Wftpserver
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FTP server host with attacker gaining SYSTEM/root privileges, enabling data theft, lateral movement, ransomware deployment, or persistent backdoor installation.
Likely Case
Authenticated attackers with web console access execute commands to steal sensitive files, install malware, or pivot to other systems on the network.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and command execution restrictions are in place.
🎯 Exploit Status
Exploit requires valid credentials but uses simple POST requests with command injection. Public exploit code is available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.4.0 and later
Vendor Advisory: https://www.wftpserver.com/
Restart Required: Yes
Instructions:
1. Download latest version from vendor website. 2. Backup configuration and data. 3. Run installer to upgrade. 4. Restart Wing FTP Server service. 5. Verify web console functionality.
🔧 Temporary Workarounds
Disable Web Console
allCompletely disable the vulnerable Lua-based web console interface
Edit server configuration to disable web console or remove web console access permissions
Restrict Web Console Access
allLimit web console access to specific IP addresses or disable for non-admin users
Configure firewall rules to block web console port (5466 by default) from untrusted networks
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FTP server from critical systems
- Enforce strong authentication policies and monitor for suspicious web console login attempts
🔍 How to Verify
Check if Vulnerable:
Check Wing FTP Server version in admin interface or configuration files. Version 6.3.8 or earlier with web console enabled is vulnerable.Check Version:
Check server admin interface or configuration file for version numberVerify Fix Applied:
Verify version is 6.4.0 or later and test web console functionality to ensure commands cannot be executed via POST requests.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to web console with command-like parameters
- Multiple failed authentication attempts followed by successful login
- System command execution events in server logs
Network Indicators:
- POST requests to /console endpoint with os.execute or system command parameters
- Unusual outbound connections from FTP server
SIEM Query:
source="wingftp.log" AND (POST AND console AND (os.execute OR cmd.exe OR /bin/bash))