Wing FTP Server < 7.4.4 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241999);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/17");

  script_cve_id("CVE-2025-47812", "CVE-2025-47813");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/03/30");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/08/04");

  script_name(english:"Wing FTP Server < 7.4.4 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote FTP service is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote FTP server is running a version of Wing FTP Server earlier than 7.4.4. It is, therefore, affected by
multiple vulnerabilities, as follows:

  - In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately
    allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary
    system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote
    code execution vulnerability that guarantees a total server compromise. This is also exploitable via
    anonymous FTP accounts. (CVE-2025-47812)

  - loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application
    when using a long value in the UID cookie. (CVE-2025-47813)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.wftpserver.com/serverhistory.htm#gotop");
  # https://thehackernews.com/2025/07/critical-wing-ftp-server-vulnerability.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f646db7");
  # https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ea3bdb1f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 7.4.4 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-47812");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Wing FTP Server Authenticated Command Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wftpserver:wing_ftp_server");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"FTP");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wing_ftp_server_detect.nasl");
  script_require_keys("SMB/Wing_FTP/Version");

  exit(0);
}

version = get_kb_item_or_exit('SMB/Wing_FTP/Version');
path = get_kb_item_or_exit('SMB/Wing_FTP/Path');

# Check if the version is vulnerable.
fixed = '7.4.4';

if (ver_compare(ver:version, fix:fixed, strict:FALSE) == -1)
{
  port = get_kb_item('SMB/transport');
  if (report_verbosity > 0)
  {
    report =
      '\n  Path              : ' + path +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : ' + fixed +
      '\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
}
else audit(AUDIT_INST_PATH_NOT_VULN, 'Wing FTP', version, path);