Stored XSS in Wing FTP Server

Executive Summary

Wing FTP Server before 8.2.6 has a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via the nowpath parameter in webclient/makethumb.html. Attackers can manipulate the admin_get_lastconn.html XML to forge a connection ID, which executes in administrators' browsers when admin_connection_list.html auto-refreshes, potentially allowing Lua console abuse.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual requests to webclient/makethumb.html with crafted nowpath parameters. Check for unauthorized Lua console access attempts or unexpected XML responses in admin_get_lastconn.html. Inspect browser activity for auto-refreshing admin_connection_list.html executing malicious scripts.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to execute malicious scripts in the context of an administrator's browser session. This may lead to unauthorized access, data theft, or further compromise of the FTP server, including potential abuse of the Lua console for additional attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions may face regulatory penalties or legal consequences due to inadequate security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Wing FTP Server to version 8.2.6 or later. Restrict access to the webclient/makethumb.html endpoint and validate all nowpath parameters. Disable auto-refresh in admin_connection_list.html and audit Lua console access logs for suspicious activity.

Useful 0 Not Useful 0