This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: `loginok.html` leaks the local installation path via an error message. ๐ฅ **Consequences**: Information Disclosure (CWE-209).โฆ
๐ก๏ธ **Root Cause**: Improper validation of the `UID` session cookie. ๐ **Flaw**: Supplying an overlong `UID` value triggers a server error that exposes the full local filesystem path.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: Wing FTP Server. ๐ **Versions**: All versions **prior to 7.4.4**. ๐ข **Vendor**: wftpserver.
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Hackers Can**: Disclose the local file system path. ๐งฉ **Impact**: This info aids in chaining attacks (e.g., CVE-2025-47812). It does NOT directly grant RCE but enables it.
๐ **Public Exp**: Yes. ๐งช **PoC**: Available via Nuclei templates (projectdiscovery). ๐ **Link**: `http/cves/2025/CVE-2025-47813.yaml`. ๐ **Wild Exp**: Low complexity, but auth required.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Send a malformed/overlong `UID` cookie to `/loginok.html`. ๐ **Indicator**: Look for error responses containing the full local filesystem path.
Q8Is it fixed officially? (Patch/Mitigation)
๐ ๏ธ **Fixed**: Yes. โ **Patch**: Upgrade to **Wing FTP Server 7.4.4** or later. ๐ **Published**: 2025-07-10.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Restrict access to `/loginok.html`. ๐ **Mitigation**: Ensure strict input validation for `UID` cookies. ๐ **Block**: Limit network exposure if possible.
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: High Priority. ๐ **CVSS**: 5.3 (Medium). โก **Reason**: Authenticated info disclosure is a stepping stone to RCE. Patch immediately to prevent chaining attacks.