Critical Deserialization Vulnerability in Progress WS_FTP Server (CVE‑2023‑40044) Enables Authenticated Remote Command Execution
What It Is – Progress WS_FTP Server’s Ad Hoc Transfer module improperly deserializes untrusted data. An attacker who has a valid account can craft a malicious payload that triggers OS‑level command execution on the server host.
Exploitability – The flaw is exploitable without any public exploit code, but any authenticated user can leverage it. NVD assigns a CVSS v3.1 base score of 8.8 (High).
Affected Products – Progress WS_FTP Server (all supported versions at the time of disclosure).
Why It Matters for Trust & Control Assurance
- Identity & Access Controls – The issue shows that merely authenticating a user is insufficient; continuous verification of privileged actions is required to meet control‑objective evidence.
- Audit‑Ready Logging – Remote‑command execution can bypass normal logging paths; organizations need immutable logs to prove what commands were run.
- Defensible Evidence – Demonstrating that only authorized processes can invoke OS commands satisfies a core control that maps to many frameworks (e.g., NIST CSF “Protect” and ISO 27001 “Access Control”).
Recommended Actions
- Apply the vendor‑released patch for CVE‑2023‑40044 immediately.
- Enforce least‑privilege accounts for WS_FTP Server; restrict the Ad Hoc Transfer module to admin‑only roles.
- Enable and forward detailed command‑execution logs to a centralized SIEM for continuous monitoring.
- Conduct a post‑patch validation test to confirm the deserialization path is hardened.
- Review your access‑control policies and update evidence artifacts in your Trust Center.
Source: CISA KEV – CVE‑2023‑40044