CVE-2025-47812

This is a Proof of Concept (PoC) of the Wing FTP Server Exploit (CVE-2025-47812)

Description

Wing FTP Server versions prior to 7.4.4 suffered a Remote Code Execution (RCE) vulnerability as a result of the insecure treatment of the username parameter. When we are allowed to login in the /loginok.html page, we can inject a null bytes %00 followed by Lua code in order to get RCE.

Background incident

When we send a POST request to the loginok.html page the c_CheckUser() function (the one that validates the proper username and password) uses strlen(). The issue es that the relied function is vulnerable to null bytes truncation. This means that if we send the %00 after the username, the c_CheckUser() will only validate the string portion before the null byte: "anonymous%00........." --> "anonymous".

Afterwards, the application creates a SESSION variable, which is written to a file. However, this file contains not only the username, but also the entire string including the null byte and the following code. As the file is a Lua file, Lua code can be injected resulting in a RCE.

Exploitation

Imagine the anonymous login is allowed. If we send a POST request with this sctructure: username=anonymous%00]]%0dlocal+h+%3d+io.popen("whoami")%0dlocal+r+%3d+h%3aread(\"*a\")%0dh%3aclose()%0dprint(r)%0d--&password=&username_val=anonymous&password_val= we will have injected the whoami command after the null bytes using Lua code. Once he have done this, we need to copy the UID of the response and send a GET request to any authenticated page, for instance the dir.html page by using the same UID.

The CVE-2025-47812.py script makes the proccess for us.