Wing FTP Server: Unauthenticated Lua injection remote code execution (CVE-2025-47812)

Wing FTP Server versions 7.4.3 and earlier are vulnerable to a critical unauthenticated remote code execution (RCE) flaw. The vulnerability exists within the c_CheckUser() function, where the username is truncated at the first NULL byte for authentication checks. However, the session creation process writes the full, unsanitized username into a Lua-based session file. By injecting a specially crafted payload containing Lua syntax, an attacker can cause the server to write malicious code into this session file. Accessing any authenticated endpoint subsequently triggers loadfile() on the session file, executing the injected Lua code with the privileges of the Wing FTP process (typically SYSTEM on Windows or root on Linux).

Attack Chain

1. Attacker sends a crafted request to the server containing a NULL byte injected into the username parameter (e.g., anonymous%00]]<lua>--).
2. The c_CheckUser() authentication function truncates the input at the NULL byte, allowing the request to proceed.
3. The server writes the full, unsanitized username string into a persistent session file.
4. The malicious Lua payload is successfully stored within the session file.
5. The attacker requests an authenticated endpoint, such as dir.html.
6. The server loads the session file via loadfile(), inadvertently executing the attacker-supplied Lua code.

Impact

Successful exploitation allows for full system compromise, granting the attacker the same privileges as the Wing FTP Server process, which is often running as root or SYSTEM.

Recommendation

1. Upgrade Wing FTP Server to version 7.4.4 or later immediately.
2. Inventory all instances of Wing FTP Server in the environment to identify systems running version 7.4.3 or earlier.
3. Monitor web server logs for requests containing NULL bytes or suspicious Lua syntax in the username field.
4. Restrict access to the Wing FTP administrative and web interface ports (defaulting to 5466/5467) to authorized networks only.