PT-2023-12912 · Ipswitch · Ws Ftp Server

Published 2023-04-03 · Updated 2024-06-15 · CVE-2022-27665

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Progress Ipswitch WS FTP Server version 8.6.0

Description Reflected XSS exists due to improper handling of user-provided input, allowing execution of malicious code and commands on the client. This can be achieved by inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, enabling client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the "ThinClient/WtmApiService.asmx/GetFileSubTree" URI.

Recommendations For version 8.6.0, consider disabling the use of AngularJS sandbox escape expressions until a patch is available. Restrict access to the subFolderPath parameter in the "ThinClient/WtmApiService.asmx/GetFileSubTree" URI to minimize the risk of exploitation. Avoid using the subdirectory searchbar or Add folder filename boxes with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27665

OPENSUSE-SU-2024:12410-1

Affected Products

Ws Ftp Server

References · 9

• 🔥 https://github.com/dievus/CVE-2022-27665 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12410-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27665 · Security Note
• https://docs.ipswitch.com/WS_FTP_Server2020/ReleaseNotes/index.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27665 · Vendor Advisory
• https://suse.com/security/cve/CVE-2022-27665 · Note
• https://t.me/cibsecurity/61321 · Telegram Post
• https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023 · Note
• https://t.me/cvenotify/69448 · Telegram Post