CVE-2024-7745
📋 TL;DR
This vulnerability allows attackers to bypass multi-factor authentication in WS_FTP Server's Web Transfer Module. Users can log in with only username and password, skipping required second-factor verification. Organizations using affected WS_FTP Server versions before 8.8.8 (2022.0.8) are impacted.
💻 Affected Systems
- WS_FTP Server
📦 What is this software?
Ws Ftp Server by Progress
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive files and administrative functions, potentially leading to data theft, system compromise, or ransomware deployment.
Likely Case
Unauthorized users access sensitive files and directories they shouldn't have permission to view or download.
If Mitigated
With proper network segmentation and monitoring, impact is limited to unauthorized file access within the FTP server's scope.
🎯 Exploit Status
Exploitation requires valid username/password credentials but bypasses MFA requirement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.8.8 (2022.0.8) or later
Vendor Advisory: https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-August-2024
Restart Required: Yes
Instructions:
1. Download WS_FTP Server 8.8.8 (2022.0.8) or later from Progress Software. 2. Run the installer. 3. Restart WS_FTP Server services. 4. Verify MFA is functioning correctly.
🔧 Temporary Workarounds
Disable Web Transfer Module
windowsTemporarily disable the vulnerable Web Transfer Module while maintaining FTP/SFTP services
Stop WS_FTP Web Transfer Module service
Network Restriction
allRestrict access to WS_FTP Web Transfer Module to trusted IP addresses only
Configure firewall rules to limit access to WS_FTP Web Transfer Module port
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WS_FTP Server from critical systems
- Enable detailed logging and monitoring for authentication attempts and file access patterns
🔍 How to Verify
Check if Vulnerable:
Check WS_FTP Server version in administrative console or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\WS_FTP Server\VersionCheck Version:
reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\WS_FTP Server" /v VersionVerify Fix Applied:
Test MFA login process - second factor should be required after successful username/password entry📡 Detection & Monitoring
Log Indicators:
- Successful logins without MFA challenge completion
- Multiple failed MFA attempts followed by successful login
Network Indicators:
- Unusual file download patterns from users who previously used MFA
- Authentication requests that skip MFA step
SIEM Query:
source="ws_ftp" AND (event="login_success" AND NOT event="mfa_success")