CVE-2023-40044
CRITICAL KEV RANSOMWARE NUCLEIWS_FTP Server < 8.7.4 - Unauthenticated Remote Code Execution via .NET Deserialization
Title source: llmExploitation Summary
CVE-2023-40044 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 5, 2023, with confirmed use in ransomware campaigns.
EIP tracks 2 public exploits from researchers including kenbuckler, sfewer-r7, including a Metasploit module exploits/windows/http/ws_ftp_rce_cve_2023_40044.
A Nuclei detection template is also available.
AI-analyzed exploit summary The repository lacks exploit code or technical details about CVE-2023-40044, instead redirecting to an external news ticker and listing affected organizations. No PoC, analysis, or vulnerability specifics are provided.
Description
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
Exploits (2)
The repository lacks exploit code or technical details about CVE-2023-40044, instead redirecting to an external news ticker and listing affected organizations. No PoC, analysis, or vulnerability specifics are provided.
This Metasploit module exploits an unsafe .NET deserialization vulnerability (CVE-2023-40044) in Progress Software WS_FTP Server's Ad Hoc Transfer module to achieve unauthenticated remote code execution. It uses multiple gadget chains and targets versions prior to 2020.0.4 and 2022.0.2.
Nuclei Templates (1)
title:"Ad Hoc Transfer"
References (9)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H