CVE-2023-40044

What it actually does

CVE-2023-40044 is a remote command execution vulnerability caused by unsafe .NET deserialization in the WS_FTP Server Ad Hoc Transfer module. An unauthenticated or low-privileged network attacker can send crafted serialized data to the affected web-facing component and cause the WS_FTP Server host to deserialize attacker-controlled objects, leading to execution of arbitrary operating-system commands in the security context of the WS_FTP Server / IIS application process. Successful exploitation can provide full compromise of the file-transfer server, including access to transferred files, configuration data, credentials available to the service account, and the ability to stage additional malware or pivot internally.

Why it matters to the business

This flaw affects internet-facing managed file-transfer infrastructure, which often stores or brokers sensitive business data. Because exploitation is known to be active in the wild, is listed in CISA KEV, has a high EPSS probability, and is associated with ransomware activity, unpatched systems should be treated as high-priority exposure. A successful attack can result in theft of files, disruption of file-transfer operations, ransomware deployment, regulatory notification obligations, partner data exposure, and loss of trust in external data-exchange services.

How an attack unfolds

An attacker first identifies a publicly reachable WS_FTP Server instance with the Ad Hoc Transfer module enabled. The attacker determines that the server is running a vulnerable release prior to 8.7.4 or 8.8.2, then sends a crafted request containing malicious .NET serialized content to the Ad Hoc Transfer web component. When the application processes the request, it deserializes the attacker-controlled object and executes embedded commands on the underlying Windows host. The attacker commonly uses this initial command execution to run reconnaissance commands, write a web shell or dropper, create persistence, collect configuration and file-transfer data, and move laterally using credentials or access available from the compromised server. Because this vulnerability has been exploited in active campaigns and is flagged as used in ransomware activity, post-exploitation may include data staging, exfiltration, disabling defenses, and ransomware deployment.

How to fix it

Upgrade WS_FTP Server to a fixed release immediately: 8.7.x deployments should be upgraded to 8.7.4 or later, and 8.8.x deployments should be upgraded to 8.8.2 or later. If immediate upgrade is not possible, disable or restrict access to the Ad Hoc Transfer module, place the WS_FTP web interface behind a VPN or authenticated reverse proxy, restrict inbound access to known partner IP ranges, and block direct internet access to the affected endpoints. Rotate credentials and secrets accessible from the WS_FTP Server host, including service accounts, database credentials, API keys, and any credentials stored or used by transfer workflows. Because this issue is in CISA KEV and associated with ransomware campaigns, do not rely on compensating controls as a long-term fix; patching and compromise assessment are both required.

How to confirm the fix worked

Confirm the installed WS_FTP Server version from the product administration interface, installed program inventory, file metadata, or vendor-supported version command and verify it is 8.7.4, 8.8.2, or later. Validate that Ad Hoc Transfer endpoints are no longer reachable anonymously from untrusted networks unless explicitly required and protected. Perform an external scan to confirm exposed WS_FTP web services are patched or access-controlled. Review IIS and WS_FTP logs before and after patching to ensure no new requests are reaching vulnerable Ad Hoc Transfer paths. Where feasible, test in a controlled manner using a safe version-detection check rather than an exploit payload. Confirm that emergency mitigations, firewall rules, and reverse-proxy restrictions remain in place after upgrade.

Typical attack path

1. Scan the internet or target address ranges for exposed WS_FTP Server web interfaces, especially Ad Hoc Transfer endpoints.
2. Fingerprint the WS_FTP Server version or infer vulnerability from exposed files, headers, behavior, or default paths.
3. Send a crafted request containing malicious .NET serialized data to the vulnerable Ad Hoc Transfer module.
4. Trigger deserialization and execute operating-system commands under the WS_FTP Server / IIS application identity.
5. Run reconnaissance commands such as user, network, directory, and process enumeration.
6. Drop a web shell, command stager, remote access tool, or script-based payload to maintain access.
7. Access WS_FTP configuration, transfer directories, logs, stored files, service credentials, or database connection material available to the application.
8. Exfiltrate sensitive transferred files or use the server as a pivot point into adjacent systems.
9. Optionally deploy ransomware or other destructive payloads after privilege escalation and lateral movement.

How to detect it

Investigate both exploit attempts and post-exploitation activity. Primary log sources include IIS web access logs for the WS_FTP web interface, WS_FTP Server and Ad Hoc Transfer application logs, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, Windows Task Scheduler logs, service-control logs, and filesystem timestamps under WS_FTP web and transfer directories. In web logs, look for unusual or repeated POST requests to Ad Hoc Transfer paths, requests with large encoded payloads, abnormal user agents, 500-series errors followed by successful responses, and access from unfamiliar external IPs. In endpoint telemetry, look for child processes spawned by IIS worker processes or WS_FTP-related processes, especially cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl.exe, mshta.exe, rundll32.exe, or archive utilities. Review web directories for newly created ASPX, ASP, DLL, config, ZIP, 7Z, or EXE files, particularly around the first suspicious request time. Check for new local users, new scheduled tasks, new services, modified startup locations, credential dumping behavior, unexpected outbound connections, bulk file reads, compression of transfer directories, and large outbound data transfers. Where threat-intelligence context is available, correlate suspicious access with known campaigns exploiting Progress WS_FTP Server deserialization vulnerabilities and ransomware precursors such as staging, exfiltration, defense evasion, and lateral movement.

• /AHT/
• Ad Hoc Transfer
• POST /AHT/
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning curl.exe
• w3wp.exe spawning mshta.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning rundll32.exe
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net localgroup administrators
• powershell -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache -split -f
• bitsadmin /transfer
• schtasks /create
• sc.exe create
• C:\Program Files (x86)\Progress\WS_FTP Server\
• C:\Program Files\Progress\WS_FTP Server\
• C:\Program Files (x86)\Ipswitch\WS_FTP Server\
• C:\Program Files\Ipswitch\WS_FTP Server\

What your security team should do

• Treat any internet-exposed vulnerable WS_FTP Server as potentially compromised and begin incident response, not just patch management.
• Upgrade immediately to WS_FTP Server 8.7.4, 8.8.2, or later; this vulnerability is in CISA KEV, was due for remediation by 2023-10-26, has high EPSS, and is associated with ransomware activity.
• Temporarily remove public access to WS_FTP Server web and Ad Hoc Transfer interfaces until patching and compromise assessment are complete.
• Collect and preserve IIS logs, WS_FTP application logs, Windows Event Logs, web directories, scheduled tasks, service configuration, and recent file-system artifacts before rebuilding or cleaning systems.
• Hunt for suspicious POST requests to Ad Hoc Transfer paths, command execution spawned by IIS or WS_FTP processes, newly written web-accessible files, and unusual archive or exfiltration activity.
• Rotate credentials and secrets that may have been accessible to the WS_FTP Server process, including service accounts and credentials used for transfer automation.
• Review transferred files and staging directories for evidence of access, tampering, compression, or bulk download after the suspected exploitation window.
• If exploitation is confirmed, isolate the host, perform malware triage, assess lateral movement, and consider rebuilding the server from trusted media after patching.