CVE-2023-40044: Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

CVE-2023-40044 is a deserialization of untrusted data vulnerability in Progress WS_FTP Server. It affects the Ad Hoc Transfer module and lets an authenticated attacker execute remote commands on the underlying operating system. This matters because successful abuse can give an attacker full control of the host, and the vulnerability is known to have been used by ransomware operators.

Defenders should treat any exposed or internet-reachable WS_FTP Server instance as high priority until they confirm the module is patched or disabled and review for signs of compromise.

How it works

The root cause is CWE-502: deserialization of untrusted data. In the Ad Hoc Transfer module, the server processes serialized objects without sufficient validation. An attacker who already has valid credentials can supply crafted data that the application deserializes into executable objects. Once those objects run, they can issue arbitrary commands under the privileges of the WS_FTP Server process, which typically has access to the local operating system and any files or network resources the service account can reach.

Because authentication is required, the initial foothold is limited to accounts that can use the Ad Hoc Transfer feature. After successful exploitation, however, the attacker can move laterally, install persistence, or deploy ransomware. Exact payload formats and request paths are not detailed here; teams must consult the vendor advisory for those specifics.

Am I affected? How to find it in your systems

Progress WS_FTP Server is commonly deployed as a managed file-transfer solution for internal and external partners. It often runs on Windows servers in DMZs or on systems that handle regulated data. Inventory every host that runs the WS_FTP Server software, including development and backup instances.

• Query asset-management tools, software inventories, and package databases for “WS_FTP Server” or the Progress product name.
• Confirm whether the Ad Hoc Transfer module is installed and enabled; the vulnerability is specific to that component.
• Compare installed versions and configuration settings against the vendor advisory; do not rely on version numbers listed elsewhere.
• Review authentication logs and application logs for unusual Ad Hoc Transfer activity, unexpected process creation, or command-line executions originating from the WS_FTP service account.
• Check network telemetry for outbound connections from WS_FTP hosts that do not match normal file-transfer patterns, especially shortly after authenticated sessions.

If the product is present and the Ad Hoc Transfer module is active, treat the system as potentially vulnerable until the vendor-recommended update or mitigation is applied.

How to remediate

Apply the vendor-supplied update or mitigation instructions for CVE-2023-40044 as the primary remediation. CISA guidance is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. After patching, restart the service and verify that the Ad Hoc Transfer module reports the fixed state.

• Restrict the service account to least privilege so that any future exploitation has limited impact.
• Disable the Ad Hoc Transfer module if the business does not require it.
• Enforce strong authentication and multi-factor authentication for all accounts that can access the module.
• Segment WS_FTP Server hosts so they cannot freely reach domain controllers, backup systems, or other high-value assets.

Document the change and re-scan the host to confirm the vulnerability is no longer present.

If you can't patch immediately

Until the official update can be installed, reduce exposure with compensating controls. Isolate the WS_FTP Server behind a firewall or network segment that allows only necessary source IPs and ports. If a web application firewall or reverse proxy sits in front of the service, enable any available virtual-patching rules that target deserialization or Ad Hoc Transfer traffic; confirm rule efficacy against the vendor advisory.

• Temporarily disable the Ad Hoc Transfer module if operations allow.
• Increase monitoring of authentication events, process creation, and outbound network connections from the host.
• Alert on any new scheduled tasks, services, or binaries written by the WS_FTP process.
• Prepare an incident-response plan that includes isolating the host and collecting forensic images if ransomware indicators appear.

These steps lower risk but do not eliminate it; schedule the permanent fix as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently lead to data theft or ransomware deployment. If logs or telemetry suggest successful exploitation, assume the host and any data it could reach may be compromised. Rotate credentials, examine file-transfer logs for unauthorized downloads, and follow your incident-response playbook. Readers can also run a free exposure scan of their email addresses against known breach data sets to determine whether personal or corporate accounts appear in public breach corpora.