CVE-2024-4040

Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

From the Tenable Blog

CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited

Published: 2024-04-23

A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.

References

https://www.bleepingcomputer.com/news/security/critical-auth-bypass-bug-in-crushftp-now-exploited-in-attacks/

https://www.theregister.com/2025/03/27/crushftp_cve/

https://www.horizon3.ai/attack-research/crushftp-authentication-bypass-indicators-of-compromise/

https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-unauthenticated-access-flaw-immediately/

https://symantec-enterprise-blogs.security.com/threat-intelligence/ransomware-attacks-rebound

https://www.bleepingcomputer.com/news/security/over-1-400-crushftp-servers-vulnerable-to-actively-exploited-bug/

https://www.tenable.com/blog/cve-2024-4040-crushftp-virtual-file-system-vfs-sandbox-escape-vulnerability-exploited

https://therecord.media/crushftp-file-transfer-vulnerability-patch-asap

https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/

https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/

https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update

https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update

https://github.com/airbus-cert/CVE-2024-4040

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3