CVE-2025-27889: Wing FTP Server Information Disclosure Flaw

CVE-2025-27889 Overview

CVE-2025-27889 is an Input Validation Error vulnerability affecting Wing FTP Server versions prior to 7.4.4. The flaw exists in the downloadpass.html endpoint, which fails to properly validate and sanitize the url parameter. This allows attackers to inject arbitrary links that, when clicked by a user, can disclose cleartext passwords to the attacker.

Critical Impact

Successful exploitation enables attackers to harvest cleartext credentials from users who interact with crafted malicious links, potentially leading to complete account compromise and unauthorized access to sensitive file transfer operations.

Affected Products

• Wing FTP Server versions prior to 7.4.4
• Wftpserver Wing FTP Server (all platforms)

Discovery Timeline

• 2025-07-10 - CVE-2025-27889 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2025-27889

Vulnerability Analysis

The vulnerability resides in the web interface component of Wing FTP Server, specifically within the downloadpass.html endpoint. This endpoint accepts a url parameter that should point to legitimate download resources. However, due to insufficient input validation, attackers can manipulate this parameter to inject arbitrary external URLs.

When a legitimate user receives and clicks a crafted link containing the malicious url parameter, the application may redirect or transmit sensitive information—including cleartext passwords—to an attacker-controlled server. This attack vector requires user interaction, making it a social engineering-enabled vulnerability that exploits the trust users place in legitimate Wing FTP Server URLs.

The vulnerability is particularly concerning for organizations using Wing FTP Server in multi-user environments where password-protected downloads are common. The exploitation could lead to credential theft, unauthorized file access, and potential lateral movement within network infrastructure.

Root Cause

The root cause stems from CWE-15: External Control of System or Configuration Setting. The downloadpass.html endpoint lacks proper validation of the url parameter, failing to restrict it to trusted internal resources. The application does not implement allowlist validation, URL scheme restrictions, or domain verification before processing user-supplied URLs.

Attack Vector

The attack is network-based and requires user interaction to succeed. An attacker constructs a malicious URL targeting the vulnerable Wing FTP Server instance with a crafted url parameter pointing to an attacker-controlled domain. The attacker then distributes this link through phishing emails, messages, or other social engineering tactics.

When the victim clicks the link while authenticated or when providing download credentials, the application processes the malicious URL parameter and inadvertently transmits the user's cleartext password to the attacker's server. The attacker can then capture these credentials for unauthorized access.

The vulnerability allows injection of arbitrary links into the download password flow. When a user interacts with a crafted URL, the application fails to validate the destination, causing sensitive authentication data to be sent to an attacker-controlled endpoint. For detailed technical analysis, refer to the GitHub CVE Advisory and the RCESecurity analysis.

Detection Methods for CVE-2025-27889

Indicators of Compromise

• Unusual HTTP requests to the downloadpass.html endpoint containing external URLs in the url parameter
• Outbound connections from Wing FTP Server to unexpected external domains
• Log entries showing url parameter values pointing to non-internal resources
• User reports of suspicious links claiming to be from the Wing FTP Server installation

Detection Strategies

• Monitor web server access logs for requests to downloadpass.html with suspicious url parameter values containing external domains
• Implement network-level inspection for outbound credential-bearing traffic from the Wing FTP Server
• Deploy URL filtering to detect and alert on crafted links targeting the vulnerable endpoint
• Use SentinelOne Singularity to detect anomalous network behavior and potential credential exfiltration attempts

Monitoring Recommendations

• Configure alerting for any requests to downloadpass.html containing url parameters with external hostnames or IP addresses
• Implement email gateway scanning to identify and quarantine phishing emails containing malicious Wing FTP Server URLs
• Enable verbose logging on Wing FTP Server web interface to capture all parameter values for forensic analysis

How to Mitigate CVE-2025-27889

Immediate Actions Required

• Upgrade Wing FTP Server to version 7.4.4 or later immediately
• Review access logs for any prior exploitation attempts targeting the downloadpass.html endpoint
• Notify users to be cautious of suspicious links claiming to redirect to download pages
• Consider temporarily restricting external access to the Wing FTP web interface until patching is complete

Patch Information

Wing FTP Server version 7.4.4 addresses this vulnerability by implementing proper input validation and sanitization for the url parameter in the downloadpass.html endpoint. Organizations should upgrade to this version or later to remediate the vulnerability. Refer to the WFTP Server Documentation for upgrade instructions and release notes.

Workarounds

• Implement web application firewall (WAF) rules to block requests containing external URLs in the url parameter of downloadpass.html
• Restrict access to the Wing FTP web interface to trusted networks only using firewall rules
• Configure reverse proxy rules to validate and sanitize the url parameter before forwarding to the backend server
• Educate users about the risks of clicking links in emails, even those appearing to originate from trusted internal systems

# Example WAF rule to block external URLs in downloadpass.html requests
# Block requests where url parameter contains http:// or https:// external domains
SecRule REQUEST_URI "@contains /downloadpass.html" "chain,id:1001,deny,status:403"
SecRule ARGS:url "!@beginsWith /local/" "log,msg:'Potential CVE-2025-27889 exploitation attempt'"