CVE-2020-37032: Wing FTP Server Admin Console Flaw Allows Authenticated Attackers to Execute System-Level Commands Remotely

CVE-2020-37032 — Wing FTP Server — Authenticated Remote Command Execution via Lua Console

CVE Name: CVE-2020-37032
Product: Wing FTP Server
Vulnerability Type: Remote Command Execution (RCE) via administrative Lua script interpreter
CVSS Score: 8.8 (High)
Severity: High
Exploitability: Requires valid admin or authorized account to reach the Lua scripting console
Exploit Availability: Proof-of-concept exploit code and scanner modules have been published publicly

Official patch / upgrade link:
🔗 https://www.wftpserver.com/serverhistory.htm

Overview

Wing FTP Server included a built-in web-based administrative interface that lets administrators interact with the server through a console implemented in the Lua scripting language. Instead of safely limiting what Lua scripts can do, the server allowed Lua to call underlying operating-system functions. Because those functions were not restricted, an authenticated user with access to the admin console could submit scripts that ultimately invoked operating-system commands.

When such a script is accepted by the server, the script execution context runs with the same privileges as the FTP service. In many deployments, that is a very high privileged account (on Windows it often runs as SYSTEM, on Linux often as root or another powerful user). This means that running a crafted Lua script could allow an authenticated attacker to execute arbitrary commands on the host machine — from reading and writing files to launching shells or dropping backdoors.

Although an attacker must first authenticate, this does not make the issue minor. In real environments, administrators sometimes expose the web UI to untrusted networks or use weak or reused credentials. If those credentials are compromised, the attacker can immediately escalate to full system compromise through this flaw.

How the Vulnerability Works

Admin Console Entry Point:
Wing FTP Server administrators use a web UI to manage the server. As part of that UI, there is a Lua scripting page intended for legitimate automation or diagnostics.
Lua Interpreter Exposure:
Instead of sandboxing the interpreter so that scripts run in a memory-safe, restricted environment, the server exposes the full Lua engine with access to OS-level functions.
Unsafe OS Functions:
Lua has built-in functions like os.execute() and io.popen() that let scripts invoke system commands. Because input was not restricted, anything passed into those functions would be run.
Crafted Script Submission:
An attacker with UI access crafts a script containing calls to these unsafe functions and sends it via a normal admin browser request. The server processes the script and hands it straight to the Lua interpreter.
Command Execution:
The OS command runs with the same permissions as the Wing FTP server process — potentially granting system-level access.
Impact:
Once OS commands run, the attacker can copy or modify files, install backdoors, create new user accounts, pivot to other systems, or even wipe critical data.

Proof-of-Concept and Exploit Availability

Proof-of-concept exploit code was published on public exploit platforms showing how to take advantage of this vulnerability. These exploits automate the process of submitting a Lua script with system calls embedded, then turning that into a remote command shell or payload beacon. Exploit modules for popular frameworks exist that take a username and password, authenticate to the admin interface, and then inject a payload that gives an interactive shell.

Important educational note: PoC code should only be run in a controlled lab environment on non-production systems that you are authorized to test. Running exploit code against production systems without permission is unethical and illegal.

Indicators of Attack and How to Detect Exploitation

There are multiple ways to detect if someone has tried to exploit this weakness:

A — Web Server / Application Logging

Look for:

HTTP POST requests to the admin interface where the request body contains scripting content instead of normal form data.
Large or unusual POST payloads targeting admin console endpoints.
Requests that contain keywords associated with OS invocation such as os.execute( or io.popen(.

These are high-confidence indicators because a normal administrator typically does not send scripting commands directly through the UI.

B — System Process Logging

Once exploitation is attempted, the attacker’s commands often result in new processes being spawned. Monitor:

Command interpreters such as cmd.exe, powershell.exe (Windows) or /bin/sh, /bin/bash (Linux) being launched by the Wing FTP server process.
Unexpected binaries or utilities running under the FTP service account context.

If your logging includes command-line arguments, unusual command lines (e.g., base64 encoded commands, downloader tools, reverse shell payloads) are strong indicators.

C — Network Monitoring

Be on the lookout for:

Outbound connections from the server to remote hosts that are outside your normal traffic patterns.
Connections on unusual ports or sustained sessions at times when no legitimate administrator is working.

These often show up when an exploit chains into a callback/reverse shell.

Ready-to-Deploy Detection Rules

Below are rule examples you can feed directly into your SIEM or IDS.

Sigma Rule — Suspicious Admin POSTs Containing Lua OS Calls

title: Wing FTP Admin Lua OS Invocation Attempt
id: 84e19c14-8b7d-4dfc-b8f8-5f3e9f295f9b
status: experimental
description: Detects HTTP POST requests to the Wing FTP administrative interface containing likely exploitation content for CVE-2020-37032.
logsource:
  product: webserver
  service: http
detection:
  selection:
    http_method: "POST"
    uri_path|contains: ["/admin", "/console", "/lua"]
    http_request_body|contains_any: ["os.execute(", "io.popen("]
  condition: selection
falsepositives:
  - Administrative debugging automation that scripts via Lua (verify authorized actions)
level: high

Sigma Rule — Wing FTP Spawning Shells or Suspicious Processes

title: Wing FTP Server Suspicious Child Process Creation
id: 3d0c7bd1-2b31-4f83-914e-94cc7dc3f301
description: Detects instances where the Wing FTP process spawns unexpected command interpreters, Powershell, or downloader tools.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 1
    ParentImage|endswith: ["wingftp.exe", "WFPService.exe"]
    Image|contains_any: ["cmd.exe", "powershell.exe", "powershell", "bitsadmin.exe", "wget.exe", "curl.exe"]
  condition: selection
level: high

How to Use These Rules

Import them into your SIEM or threat detection platform.
Tune the URI and process names to suit your own log formats (if needed).
Test in detection-only mode if you have a baseline of normal admin use.
Alert on any matches; validate if they are legitimate admin actions or suspicious.

Recommended Remediation Actions

Before an attacker can use this flaw, they must have valid access to the admin interface. However, because the vulnerability allows arbitrary OS execution once inside, the correct long-term fix is to upgrade Wing FTP Server to a non-vulnerable version available on the official patch page.

Immediate remediations:

Upgrade the FTP server using the official link above.
Restrict the admin interface to trusted internal networks or VPN only.
Rotate all administrative passwords; avoid shared or reused credentials.
Monitor logs for the indicators listed above continuously.

Final Takeaways

An authenticated remote command execution issue in Wing FTP Server’s Lua admin console.
Once authenticated, an attacker can run OS commands with high privileges.
Yes — exploit code exists and is trivial to use once credentials are obtained.
Watch for unusual admin POSTs, Lua invocation patterns, new shell processes, and outbound anomalies.
Patch to the fixed version linked above; restrict and harden admin access.