Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ws_ftp_server

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

CVE-2023-40044 is a critical vulnerability identified in Progress Software Corporation's WS_FTP Server, specifically affecting versions prior to 8.7.4 and 8.8.2. The root cause is a deserialization of untrusted data vulnerability (CWE-502) in the Ad Hoc Transfer module, which is implemented using .NET. Deserialization vulnerabilities occur when untrusted input is deserialized without proper validation, enabling attackers to craft malicious serialized objects that, when deserialized, execute arbitrary code. This flaw allows a pre-authenticated attacker to remotely execute commands on the underlying operating system hosting the WS_FTP Server. The vulnerability requires no authentication (pre-authenticated) and no user interaction, making it highly exploitable remotely over the network. The CVSS v3.1 base score is 10.0, reflecting critical impact on confidentiality, integrity, and availability, with network attack vector, low attack complexity, and no privileges or user interaction required. The scope is changed, indicating that exploitation affects components beyond the vulnerable module. Although no public exploits have been reported yet, the nature of the vulnerability and its critical severity make it a prime target for attackers. WS_FTP Server is widely used for secure file transfer in enterprise environments, often handling sensitive data and integrated into critical workflows. The Ad Hoc Transfer module's vulnerability could lead to complete system compromise, data exfiltration, ransomware deployment, or lateral movement within networks. The lack of available patches at the time of reporting increases urgency for mitigation.

Detailed information about CVE-2023-40044: CWE-502 Deserialization of Untrusted Data in Progress Software Corporation WS_FTP Server affecting Progress Software 

CVE-2023-40044: CWE-502 Deserialization of Untrusted Data in Progress Software Corporation WS_FTP Server - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-40044: CWE-502 Deserialization of Untrusted Data in Progress Software Corporation WS_FTP Server

Threats Tagged 'cve-2023-40044'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2023-40044'

Lead Pen Test Professional