Progress Software, the makers of the popular MOVEit enterprise managed file transfer program, have confirmed the presence of multiple new critical vulnerabilities in their WS_FTP file transfer tool that could be exploited by threat actors. In May 2023, organizations using the MOVEit file transfer solution were attacked by Cl0p Ransomware actors who exploited three (3) zero-day and N-day vulnerabilities in MOVEit to compromise over 2,100 organizations and 62 million individuals. Cl0p’s apparent mission for the compromise was to exfiltrate large datasets of sensitive information from organizations who depend on MOVEit transfer, and then extort the affected entities by freely posting the information on their dark web leak site until the companies agree to pay the demanded ransom. Although the initially exploited vulnerabilities have been patched, there are still hundreds of datasets available on Cl0p Leaks, and many organizations are still dealing with the aftermath months later. On September 27, 2023, Progress Software reported that there are several new flaws affecting their WS_FTP Server Ad hoc Transfer Module, and WS_FTP Server manager interface, with the two (2) most severe vulnerabilities receiving CVSS scores of 10/10 and 9.9/10. The first and most severe flaw, tracked as CVE-2023-40044, is a .NET deserialization vulnerability which if successfully exploited, could allow an attacker with access to the target network to conduct remote code execution (RCE). The second most severe flaw, tracked as CVE-2023-42657, is a directory traversal vulnerability which could allow attackers to perform file operations (delete, rename, rmdir, mkdir) on files and folders outside of their authorized WS_FTP folder paths. Several other issues received severity scores ranging from 5.3 to 8.3, and their details can be found in the Progress Software advisory linked below. These flaws have been classified as “low-complexity attacks”, meaning that even unsophisticated actors could successfully exploit the vulnerabilities. According to Progress Software, at this time there is no evidence that these vulnerabilities are being actively exploited. The flaws affect all versions of WS_FTP Server and can be mitigated by applying version-specific hotfixes. CTIX analysts recommend that all entities leveraging WS_FTP for their file transfer needs ensure that they are running the most secure version of their software. For a comprehensive review of the MOVEit cyberattack, read CTIX MOVEit Transfer Attack Campaign: Analysis.