CVE-2023-33263
📋 TL;DR
WFTPD 3.25 stores usernames and password hashes in a plaintext configuration file (wftpd.ini) that is readable without authentication. This allows any user with file system access to obtain credentials. This affects all deployments of WFTPD 3.25 from 2006.
💻 Affected Systems
- WFTPD
📦 What is this software?
Wftpd by Wftpd Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain password hashes, crack them offline, gain unauthorized FTP access, and potentially pivot to other systems using reused credentials.
Likely Case
Local users or attackers with file access steal credentials, gain unauthorized FTP access, and exfiltrate or modify files.
If Mitigated
With proper file permissions and network segmentation, impact is limited to credential exposure without successful exploitation.
🎯 Exploit Status
Exploitation requires file system access to read wftpd.ini. No authentication needed for file access if permissions are misconfigured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch exists. Replace WFTPD with modern, supported FTP software.
🔧 Temporary Workarounds
Restrict File Permissions
windowsSet strict NTFS permissions on wftpd.ini to allow read/write only to SYSTEM and administrators.
icacls "C:\Path\To\WFTPD\wftpd.ini" /inheritance:r /grant "SYSTEM":F /grant "Administrators":F
Move Configuration File
windowsRelocate wftpd.ini to a protected directory with restricted access.
Move wftpd.ini to a secure location and update WFTPD configuration to point to new path
🧯 If You Can't Patch
- Disable WFTPD service and use alternative secure FTP solution
- Implement network segmentation to isolate WFTPD server from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check if wftpd.ini exists in WFTPD directory and contains plaintext usernames and password hashes.Check Version:
Check WFTPD about dialog or registry key: HKEY_LOCAL_MACHINE\SOFTWARE\WFTPD\VersionVerify Fix Applied:
Verify wftpd.ini has restricted permissions (only SYSTEM/Administrators can read) or has been moved/encrypted.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to wftpd.ini file
- Failed authentication attempts with stolen credentials
Network Indicators:
- Unusual FTP connections from new IP addresses
- Multiple failed login attempts
SIEM Query:
EventID=4663 ObjectName="*wftpd.ini" OR EventID=4625 LogonType=3 ProcessName="*ftp*"