CVE-2025-27889: Wing FTP Server Information Disclosure Flaw

CVE-2025-27889 Overview

CVE-2025-27889 is a high-severity input validation vulnerability in Wing FTP Server before version 7.4.4. The flaw resides in the downloadpass.html endpoint, which fails to properly validate and sanitize the url parameter. Attackers can inject an arbitrary link into the endpoint, redirecting authenticated users to attacker-controlled destinations. When a user clicks a crafted link, the application discloses a cleartext password to the attacker. The vulnerability maps to [CWE-15] (External Control of System or Configuration Setting) and requires user interaction to succeed. Wing FTP Server is a commercial multi-protocol file transfer server widely deployed in enterprise environments for secure file exchange.

Critical Impact

Successful exploitation discloses cleartext user passwords to remote attackers, enabling account takeover and lateral movement into FTP-accessible infrastructure.

Affected Products

• Wing FTP Server versions prior to 7.4.4
• wftpserver wing_ftp_server (all releases before the fixed version)
• Deployments exposing the downloadpass.html endpoint to untrusted networks

Discovery Timeline

• 2025-07-10 - CVE-2025-27889 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-27889

Vulnerability Analysis

The vulnerability exists in the downloadpass.html endpoint of Wing FTP Server. This endpoint accepts a url parameter that is intended to direct users to a legitimate download or post-authentication resource. The server fails to validate the contents of this parameter against an allowlist of trusted destinations. Attackers can therefore supply arbitrary external URLs that the server reflects or honors during password handling workflows.

When a victim follows the crafted link, the server transmits the cleartext password as part of the redirected request flow. This exposes the credential to any host the attacker controls. The flaw combines an open redirect pattern with sensitive data leakage in a single request. Network-based exploitation is straightforward and requires only that a victim click a malicious link delivered through phishing or other social channels.

Root Cause

The root cause is missing input validation and output sanitization on the url parameter. The application treats user-supplied URL values as trusted configuration data, violating the [CWE-15] pattern of external control over a security-relevant setting. No allowlist, scheme check, or host comparison restricts where credentials may be sent.

Attack Vector

Exploitation is remote and requires user interaction. An attacker crafts a malicious URL targeting downloadpass.html with a url parameter pointing to an attacker-controlled host. The attacker delivers the link via email, chat, or web content. When an authenticated Wing FTP user clicks the link, the password is transmitted in cleartext to the attacker's endpoint.

The vulnerability mechanism is documented in the public GitHub CVE Advisory and related analysis at RCESecurity. No verified proof-of-concept code is published; refer to the advisory for parameter syntax.

Detection Methods for CVE-2025-27889

Indicators of Compromise

• HTTP requests to /downloadpass.html containing a url query parameter pointing to external or unexpected hosts
• Outbound connections from Wing FTP Server processes to domains not associated with the organization
• Web server access logs showing unusual referer chains terminating at downloadpass.html
• Unexplained authentication events on FTP accounts following user clicks on emailed links

Detection Strategies

• Inspect Wing FTP access logs for downloadpass.html requests where the url parameter contains schemes, hosts, or paths outside the trusted application origin
• Deploy URL filtering rules that flag query parameters carrying fully qualified external URLs to file transfer servers
• Correlate FTP authentication failures and password resets with prior clicks on suspicious links in email gateways

Monitoring Recommendations

• Enable verbose HTTP logging on Wing FTP Server and forward logs to a centralized analytics platform
• Alert on any downloadpass.html request whose url parameter resolves to an external domain
• Monitor for credential reuse patterns across services after Wing FTP user sessions

How to Mitigate CVE-2025-27889

Immediate Actions Required

• Upgrade Wing FTP Server to version 7.4.4 or later as the primary remediation
• Force password resets for all Wing FTP user accounts that may have clicked external links since deployment
• Restrict access to the Wing FTP web interface to trusted networks using firewall or reverse proxy rules
• Notify users about the phishing risk and instruct them to verify URLs before clicking links claiming to originate from the FTP server

Patch Information

The vendor addressed the vulnerability in Wing FTP Server 7.4.4. The fix introduces validation on the url parameter of the downloadpass.html endpoint. Administrators should download the patched release from the Wing FTP Server product page and verify the installed version after upgrade.

Workarounds

• Block external access to the downloadpass.html endpoint at the reverse proxy or web application firewall until patching is complete
• Implement WAF rules that reject requests to downloadpass.html where the url parameter contains an absolute URL or non-relative path
• Disable the password download or recovery feature in Wing FTP configuration if the workflow is not required by the business

# Example nginx rule blocking external URLs in the url parameter
location /downloadpass.html {
    if ($arg_url ~* "^(https?:|//)") {
        return 403;
    }
    proxy_pass http://wingftp_backend;
}