Wing FTP Server Remote Code Execution Vulnerability via Session Serialization

A remote code execution vulnerability has been identified in Wing FTP Server version 8.1.2. This issue arises from the session serialization process, which allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. The vulnerability exploits the unsafe serialization of session values into Lua source code, as closing delimiters are not properly escaped. Consequently, the injected code is executed when the compromised session is loaded using the loadfile() function.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server.

Remediation

Users can upgrade to Wing FTP Server version 8.1.3 or later to address this vulnerability.