CVE-2020-37079
📋 TL;DR
This CSRF vulnerability in Wing FTP Server's web administration interface allows attackers to delete administrative user accounts without authorization. Attackers can craft malicious web pages that trick authenticated administrators into executing unwanted actions. All Wing FTP Server installations with web administration enabled and running versions before 6.2.7 are affected.
💻 Affected Systems
- Wing FTP Server
📦 What is this software?
Wing Ftp Server by Wftpserver
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of administrative access to the FTP server, requiring manual recovery or reinstallation, potentially causing extended service disruption.
Likely Case
Administrative user deletion leading to temporary loss of management capabilities until account restoration or manual intervention.
If Mitigated
No impact if proper CSRF protections are implemented or if the vulnerability is patched.
🎯 Exploit Status
Exploitation requires the victim administrator to be logged into the web interface and visit a malicious page. Proof-of-concept exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.7
Vendor Advisory: https://www.wftpserver.com/serverhistory.htm
Restart Required: Yes
Instructions:
1. Download Wing FTP Server version 6.2.7 or later from the official website. 2. Stop the Wing FTP Server service. 3. Install the updated version. 4. Restart the service.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to web administration forms to validate legitimate requests.
Restrict Web Admin Access
allLimit access to the web administration interface to trusted IP addresses only.
# Configure firewall rules to restrict access to Wing FTP admin port (default 5466)
🧯 If You Can't Patch
- Disable web administration interface and use only local management tools
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions
🔍 How to Verify
Check if Vulnerable:
Check Wing FTP Server version in administration interface or via 'wingftpserver --version' command. If version is below 6.2.7, the system is vulnerable.Check Version:
wingftpserver --versionVerify Fix Applied:
Verify version is 6.2.7 or higher and test that CSRF protection is working by attempting to submit forms without proper tokens.📡 Detection & Monitoring
Log Indicators:
- Unexpected admin user deletion events
- Multiple failed login attempts followed by user deletion
Network Indicators:
- HTTP POST requests to admin user deletion endpoints from unexpected sources
- CSRF token validation failures
SIEM Query:
source="wingftp.log" AND (event="user_deleted" OR event="admin_deleted")