# RCE in Progress WS_FTP Ad Hoc via IIS HTTP Modules (CVE-2023-40044)

Unauthenticated BinaryFormatter deserialization in WS_FTP Ad Hoc Transfer's MyFileUpload.UploadModule IIS HTTP module lets attackers run arbitrary commands via a crafted multipart field.

- Payout: Research
- Severity: critical
- Program: Progress WS_FTP
- Credited: Assetnote
- Disclosed: 2025-02-12
- CVE: CVE-2023-40044
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:dotnet technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:deserialization vuln:rce

**Target:** IIS HTTP module (MyFileUpload.UploadModule) in WS_FTP Ad Hoc Transfer web app
**Root cause:** The UploadModule parses multipart fields and passes the ::AHT_DEFAULT_UPLOAD_PARAMETER:: value to UploadManager.DeserializeProcessor, which Base64-decodes it and feeds it to BinaryFormatter.Deserialize with no auth check or type restriction.
**Steps:**
1. Download WS_FTP Server 2022.0.1 trial and decompile with ILSpy; locate web.config httpModules entry for MyFileUpload.UploadModule
2. Trace UploadModule -> FormStream.ProcessField -> CheckForActionFields -> UploadManager.Instance.DeserializeProcessor
3. Generate payload: `ysoserial.exe -g TypeConfuseDelegate -f BinaryFormatter -c "cmd.exe /C nslookup <oast>" -o base64`
4. Send unauthenticated `POST /AHT/AhtApiService.asmx/AuthUser` with `Content-Type: multipart/form-data` and a field named `""` whose value is `::AHT_DEFAULT_UPLOAD_PARAMETER::<base64>`
5. Observe DNS callback confirming command execution
**How found:** Sink-to-source review: decompiled the .NET binary, spotted the BinaryFormatter.Deserialize sink in DeserializeProcessor, then walked up the call chain through FormStream/CheckForActionFields to find the multipart field that reaches it pre-auth; dynamic debugging confirmed the tainted input landed in the MemoryStream.
**Exploitation:** Unauthenticated attacker sends a single multipart POST to any AHT route; the HTTP module intercepts it on every request cycle, extracts the default-params field, and BinaryFormatter-deserializes the ysoserial TypeConfuseDelegate gadget to spawn cmd.exe. Because the module runs on all routes, the GET URL can be arbitrary, evading URL-based WAF rules.
**Insight:** IIS HTTP modules run on every request regardless of route, so a deserialization sink inside one is reachable from any endpoint and bypasses URL-path-based WAF rules; grep web.config httpModules for upload/parse logic and trace multipart field names like ::AHT_DEFAULT_UPLOAD_PARAMETER:: to BinaryFormatter sinks.