CVE-2023-42657: Progress WS_FTP Server Path Traversal

CVE-2023-42657 Overview

CVE-2023-42657 is a critical directory traversal vulnerability affecting Progress WS_FTP Server versions prior to 8.7.4 and 8.8.2. This vulnerability allows authenticated attackers to escape the authorized WS_FTP folder path and perform unauthorized file operations including delete, rename, rmdir, and mkdir on files and folders outside their designated directory structure. More critically, attackers can escape the WS_FTP Server file structure entirely and execute these same file operations on arbitrary locations within the underlying operating system.

Critical Impact

Attackers with low-privileged access can manipulate critical system files and directories outside of the WS_FTP sandbox, potentially leading to complete system compromise, data destruction, or denial of service through deletion of essential operating system components.

Affected Products

• Progress WS_FTP Server versions prior to 8.7.4
• Progress WS_FTP Server versions prior to 8.8.2
• All WS_FTP Server deployments running vulnerable versions

Discovery Timeline

• September 27, 2023 - CVE-2023-42657 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-42657

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) exists due to insufficient validation of user-supplied file paths in the WS_FTP Server application. When users perform file operations through the FTP interface, the server fails to properly sanitize path components, allowing the inclusion of directory traversal sequences that navigate outside the intended directory scope.

The vulnerability is particularly severe because it affects multiple file system operations simultaneously—not just read operations, but destructive operations like delete, rename, and directory manipulation. This broad impact surface means attackers can cause significant damage to both application data and host system integrity.

The attack requires network access and low-level privileges (authenticated user account), but once authenticated, the attacker can leverage the traversal to reach any location the WS_FTP service account has permissions to access on the underlying operating system.

Root Cause

The root cause of CVE-2023-42657 lies in improper input validation within the WS_FTP Server's file path handling routines. The application fails to adequately normalize and validate file paths before processing file operations, allowing sequences such as ../ or encoded variants to traverse beyond the designated user directory boundaries. This insufficient path canonicalization enables the bypass of intended access controls, extending the attacker's reach from the restricted FTP environment to the broader file system.

Attack Vector

The attack is conducted over the network against authenticated WS_FTP Server sessions. An attacker first authenticates with valid (potentially low-privileged) credentials to establish an FTP session. Once connected, the attacker crafts file operation requests containing directory traversal sequences to target files and directories outside their authorized path.

The traversal sequences allow the attacker to navigate upward from the WS_FTP jail directory, ultimately reaching the root of the file system or any other accessible location. From there, the attacker can execute delete, rename, mkdir, and rmdir operations against critical system files, application configurations, databases, or other sensitive data residing on the server.

Detection Methods for CVE-2023-42657

Indicators of Compromise

• Presence of directory traversal sequences (../, ..%2F, ..%5C) in FTP command logs
• Unexpected file deletions or directory modifications outside of WS_FTP data directories
• FTP session logs showing operations targeting system paths like C:\Windows\ or /etc/
• Anomalous file operation failures indicating attempted access to restricted paths

Detection Strategies

• Implement log monitoring for FTP commands containing path traversal patterns
• Deploy file integrity monitoring (FIM) on critical system directories and WS_FTP installation folders
• Configure SIEM rules to alert on suspicious file operations originating from WS_FTP service processes
• Monitor for unusual patterns of delete, rename, mkdir, or rmdir operations in FTP logs

Monitoring Recommendations

• Enable verbose logging in WS_FTP Server to capture full file operation paths
• Correlate FTP authentication events with subsequent file system activities
• Monitor the WS_FTP service account for file operations outside expected directories
• Implement network-based detection for FTP traffic containing traversal sequences

How to Mitigate CVE-2023-42657

Immediate Actions Required

• Upgrade WS_FTP Server to version 8.7.4 or later for the 8.7.x branch
• Upgrade WS_FTP Server to version 8.8.2 or later for the 8.8.x branch
• Review FTP logs for signs of exploitation prior to patching
• Audit file system integrity to identify any unauthorized modifications

Patch Information

Progress Software has released security patches addressing this vulnerability. Organizations should immediately upgrade to WS_FTP Server version 8.7.4 or 8.8.2 (or later) depending on their deployment branch. Detailed patch information and installation instructions are available in the Progress WS-FTP Critical Vulnerability Advisory.

Workarounds

• Restrict network access to WS_FTP Server to trusted IP ranges only
• Implement additional network segmentation to isolate FTP servers from critical systems
• Run WS_FTP Server service under a minimal-privilege account to limit traversal impact
• Deploy web application firewall (WAF) or network intrusion prevention rules to filter traversal attempts
• Temporarily disable WS_FTP Server if immediate patching is not possible and risk is unacceptable

# Example: Restrict WS_FTP Server access via Windows Firewall
# Allow only specific trusted IP ranges to connect to FTP port
netsh advfirewall firewall add rule name="WS_FTP Restricted Access" ^
    dir=in action=allow protocol=TCP localport=21 ^
    remoteip=10.0.0.0/8,192.168.1.0/24 ^
    program="C:\Program Files\WS_FTP Server\ftpsvc.exe"