Tasting the Exploit: HackerHood testa l’exploit su Wing FTP Server del CVE‑2025‑47812 da Score 10

Redazione RHC : 15 July 2025 10:09

This tool is intended solely for authorized educational and penetration testing purposes. The author assumes no responsibility for any misuse or damage caused by this software. Always ensure you have explicit, written authorization before performing any tests on a system.

In recent days, a serious Remote Code Execution vulnerability (CVE-2025-47812) has been brought to the attention of the infosec community in the WingFTP Server software, widely used to offer FTP, FTPS, and HTTP services to thousands of companies.

The exploit for this vulnerability, which involves severe NULL byte manipulation and Lua code injection, was tested by Manuel Roccon, root of Red Hot Cyber’s HackerHood group, who recently created a subgroup called Hackerhood Pwned where security experts will test the main exploits that are published.

The CVE-2025-47812 vulnerability — with CVSSv3=10.0 — involves a flaw in the handling of NULL-terminated strings in loginok.html, allowing an unauthenticated attacker to inject arbitrary Lua code and this exploit was found to be very easy to execute (3 on a scale from 1 to 10), confirming what NIST reported as LOW.

This vulnerability is due to Wing FTP Server’s improper handling of NULL bytes in the username parameter during the authentication process. This allows attackers to inject Lua code directly into session files. These malicious session files are then executed upon loading a valid session, resulting in arbitrary commands being executed on the server.

Key features of this exploit include:

• Remote Code Execution: Execute any command you choose on the target server.
• Root/SYSTEM Privileges: Often gains an RCE with the highest system privileges due to the default Wing FTP Server configurations.
• Anonymous Access Exploitation: Can be exploited even if only anonymous access is allowed on the server.
• Batch Scan: Scans multiple targets by providing a list of URLs from a file.
• Custom Command Execution: Specify and execute any necessary commands on the vulnerable server.

The CVE-2025-47812 is a critical vulnerability resulting from multiple weaknesses in the way Wing FTP Server handles user authentication and sessions:

1. NULL byte truncation in c_CheckUser(): The c_CheckUser() function, responsible for user authentication, internally uses strlen() the provided username. When a NULL byte ( %00) is injected into the username (e.g., anonymous%00...), strlen() truncates the string at this point. This means that authentication succeeds for the portion of the username before the NULL byte, effectively bypassing proper validation.
2. Full username in session creation: Despite the authentication truncation, the rawset(_SESSION, "username", username) call within loginok.html uses the full username, unsanitized directly from the GET or POST parameters. This includes the NULL byte and all subsequent characters.
3. Lua code injection: Since session files are stored as Lua scripts, injecting Lua code after the NULL byte in the username (for example, anonymous%00]]%0dlocal+h+%3d+io.popen("id")%0dlocal+r+%3d+h%3aread("*a")%0dh%3aclose()%0dprint(r)%0d--) causes this malicious code to be written directly to the session file.
4. Session file execution: The The SessionModule.load() function, invoked when accessing an authenticated functionality (such as /dir.html), directly executes the session file using loadfile(filepath) followed by f(). This crucial step activates the injected Lua code, leading to remote code execution (RCE).

The Hackerhood/pwned group replicated the same technique in their lab, creating a visual demonstration of the attack, and released it online. The video clearly demonstrates the Lua injection, the payload download, and the execution, which opens an elevated shell. “This is how an unauthenticated attacker can, in seconds, gain full control of a WingFTP server.”

Urgent measures suggested to organizations:

Action	Detail
Immediate update	Install version 7.4.4 of Wing FTP Server (available from May 14, 2025)
Disable anonymous access	Prevent anonymous FTP access, especially over HTTP/HTTPS
Active monitoring	Check files in session/*.lua and logs in Domains/*/*.log for traces of Lua injections
Network rules	Restrict HTTP/HTTPS access to authorized clients only
System administrators	Enable antivirus/EDR such as Microsoft Defender and anomaly detection solutions

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli