CVE-2023-40047
📋 TL;DR
This stored XSS vulnerability in WS_FTP Server allows attackers with administrative privileges to inject malicious JavaScript via SSL certificate imports. The malicious code executes in administrators' browsers when viewing certificate details, potentially compromising their sessions or performing unauthorized actions. Only WS_FTP Server administrators are directly affected.
💻 Affected Systems
- Progress WS_FTP Server
📦 What is this software?
Ws Ftp Server by Progress
⚠️ Risk & Real-World Impact
Worst Case
Administrator account takeover leading to complete WS_FTP Server compromise, data exfiltration, or deployment of additional malware.
Likely Case
Session hijacking of administrator accounts, credential theft, or unauthorized configuration changes.
If Mitigated
Limited impact if administrators use separate accounts for certificate management and have strong session security.
🎯 Exploit Status
Requires administrative access to import malicious certificates.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.8.2 and later
Vendor Advisory: https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023
Restart Required: Yes
Instructions:
1. Download WS_FTP Server 8.8.2 or later from Progress website. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart WS_FTP Server services.
🔧 Temporary Workarounds
Restrict SSL Certificate Import
windowsLimit SSL certificate import capabilities to trusted administrators only.
Implement Content Security Policy
allAdd CSP headers to prevent XSS execution in management interface.
🧯 If You Can't Patch
- Restrict administrative access to WS_FTP Server management interface to only essential personnel.
- Monitor SSL certificate import activities and audit imported certificates for suspicious attributes.
🔍 How to Verify
Check if Vulnerable:
Check WS_FTP Server version in Management Console under Help > About.Check Version:
Check via WS_FTP Server Management Console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\WS_FTP Server\VersionVerify Fix Applied:
Verify version is 8.8.2 or later and test SSL certificate import functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual SSL certificate import activities
- Multiple failed login attempts followed by certificate imports
Network Indicators:
- Unexpected JavaScript execution in management interface traffic
SIEM Query:
source="ws_ftp_logs" AND (event="certificate_import" OR event="ssl_update")