EXPLOITED WING FILE TRANSFER BUG RISKS TOTAL SERVER COMPROMISE

Summary from the TLDR InfoSec newsletter

The CISA is warning users of a new critical (CVSS 10/10) vulnerability in the Wing FTP software that is under active exploitation. The vulnerability stems from Wing FTP software not sanitizing usernames that contain a NULL byte and then constructing a Lua session file from the username, which can potentially include Lua code after the NULL byte. Huntress and Arctic Wolf have both recorded that they have seen attackers exploiting exposed servers to download and execute malicious files, perform reconnaissance, and install remote monitoring and management software.