CVE-2024-7745 Overview
CVE-2024-7745 is an authentication bypass vulnerability in Progress WS_FTP Server versions before 8.8.8 (2022.0.8). The flaw resides in the Web Transfer Module and stems from a missing critical step in the multi-factor authentication (MFA) workflow. Authenticated users can skip the second-factor verification and log in using only a username and password. The issue is tracked under CWE-287 (Improper Authentication) and CWE-290 (Authentication Bypass by Spoofing). Progress released a fix in the August 2024 Service Pack.
Critical Impact
Attackers with valid credentials can bypass MFA on WS_FTP Server, defeating a key control that protects file transfer sessions and stored data.
Affected Products
- Progress WS_FTP Server versions prior to 8.8.8 (2022.0.8)
- WS_FTP Server Web Transfer Module deployments with MFA enabled
- Any Progress WS_FTP Server instance exposing web-based authentication endpoints
Discovery Timeline
- 2024-08-28 - CVE-2024-7745 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-7745
Vulnerability Analysis
The vulnerability affects the Web Transfer Module of Progress WS_FTP Server. MFA is intended to require both a password and a second-factor challenge before granting access. The authentication flow omits a critical enforcement step, allowing the session to be established after the first factor succeeds. The second-factor check is skipped entirely under attacker-controlled conditions.
An attacker who obtains valid credentials through phishing, credential stuffing, or reuse can log in as the targeted user. MFA no longer provides a compensating control. Access to file transfer resources exposes stored files, transfer logs, and any downstream systems the account can reach.
The attack is network-based and requires low complexity. It requires low-privilege credentials but no user interaction. Successful exploitation impacts confidentiality and integrity of files handled by the server.
Root Cause
The root cause is a business logic error in the authentication state machine of the Web Transfer Module. The code path that finalizes login does not verify that the MFA challenge was completed before issuing an authenticated session. This maps to CWE-287 and CWE-290, reflecting an incomplete authentication sequence rather than a cryptographic weakness.
Attack Vector
Exploitation occurs over the network against the Web Transfer Module authentication endpoint. An attacker submits valid first-factor credentials and reaches an authenticated state without responding to the MFA challenge. No client-side interaction from the legitimate user is required. See the Progress WS_FTP Server Service Pack advisory for vendor details.
No public exploit code or proof-of-concept has been published at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-7745
Indicators of Compromise
- Successful WS_FTP Web Transfer Module logins for MFA-enrolled users that lack a corresponding MFA challenge event in the same session.
- Authentication events from unexpected geolocations or IP addresses for accounts that historically complete MFA.
- Session activity that begins immediately after a password submission with no observable second-factor interaction.
Detection Strategies
- Correlate WS_FTP authentication logs to confirm every login for an MFA-enrolled account contains both a password validation and a completed MFA step.
- Alert on sessions established without the MFA step recorded, especially for administrative or service accounts.
- Review file transfer activity for anomalous downloads or configuration changes following logins that skipped MFA.
Monitoring Recommendations
- Forward WS_FTP Server web module logs and authentication events to a central SIEM or data lake for correlation and retention.
- Baseline normal MFA completion rates per user and alert on drops, which can indicate exploitation attempts.
- Monitor egress from the WS_FTP host for large or unusual data transfers that follow suspicious authentications.
How to Mitigate CVE-2024-7745
Immediate Actions Required
- Upgrade Progress WS_FTP Server to version 8.8.8 (2022.0.8) or later as published in the August 2024 Service Pack.
- Rotate credentials for all WS_FTP users, particularly administrative and service accounts, in case prior logins bypassed MFA.
- Audit recent authentication and file access logs for sessions that established without an MFA challenge.
Patch Information
Progress addressed CVE-2024-7745 in the WS_FTP Server Service Pack, August 2024. Administrators should install the update on all WS_FTP Server instances running the Web Transfer Module. Product information is available at the Progress FTP Server product page.
Workarounds
- Restrict access to the WS_FTP Web Transfer Module to trusted networks using firewall rules or a VPN until patching is complete.
- Disable the Web Transfer Module on servers that do not require web-based file access.
- Enforce strong, unique passwords and monitor for credential stuffing while MFA cannot be relied upon as a compensating control.
# Example: restrict WS_FTP Web Transfer Module to trusted subnets
# Windows Firewall inbound rule limiting TCP/443 to a management subnet
New-NetFirewallRule -DisplayName "WS_FTP Web Module - Restrict" `
-Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 `
-RemoteAddress 10.10.0.0/24
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
