crushftp

CrushFTP is a Java-based open source file transfer system. It is offered for multiple operating systems. If you run a CrushFTP instance, you may remember that the software has had some serious vulnerabilities: CVE-2024-4040 (the template-injection flaw that let unauthenticated attackers escape the VFS sandbox and achieve RCE), CVE-2025-31161 (the auth-bypass that handed over the crushadmin account on a silver platter), and the July 2025 zero-day CVE-2025-54309 that was actively exploited in the wild. But what we are seeing now is not an exploit of a specific vulnerability, but rather simple brute-forcing, looking for lazily configured systems. The requests we are seeing right now: POST /WebInterface/function/?command=login&username=crushadmin&password=crushadmin HTTP/1.1 Host: [redacted] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.137 Safari/537.36 Content-Length: 0 Accept-Encoding: gzip Connection: close Note that these are POST requests, but the username and password are passed as GET parameters. The body of the request is empty. During setup, CrushFTP requires that the user configure an admin user. The username is not fixed, but "crushadmin" is one of the suggested usernames. Others are "root" and "admin". There is no default or suggested password. The attacker relies on lazy administrators who use "crushadmin" as both a username and a password. These attacks originate from 5.189.139.225, a French IP address with a history of exploit attempts targeting simple vulnerabilities. We have seen this IP acting up since around February. -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

CrushFTP heeft een kwetsbaarheid verholpen in versies 10 tot en met 10.8.5 en 11 tot en met 11.3.4_23. De kwetsbaarheid bevindt zich in de AS2-validatie van CrushFTP. Deze kwetsbaarheid stelt een aanvaller in staat om via HTTPS administratieve toegang te verkrijgen, vooral wanneer de DMZ-proxyfunctie niet wordt gebruikt. De kwetsbaarheid is actief misbruikt, met meldingen die in juli 2025 zijn verschenen. Ongeautoriseerde toegang kan leiden tot verdere exploitatie van de getroffen systemen. Diverse onderzoekers publiceren inmiddels Proof-of-Concept-code (PoC) waarmee de kwetsbaarheid kan worden aangetoond. Daadwerkelijk misbruik is op dit moment nog niet eenvoudig te realiseren, omdat een zgn. 'Race condition' moet worden gerealiseerd. Het NCSC acht het waarschijnlijk dat op korte termijn werkende exploitcode wordt gepubliceerd, waarmee grootschalig misbruik eenvoudiger wordt.

History: 24/07/2025 --- v1.0 -- Initial publication Summary CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers [2, 3]. Threat actors were first detected exploiting the vulnerability on July 18th at 9AM CST, though it may have begun in the early hours of the previous day [1]. Techincal details The attack occurs via the software's web interface in versions prior to CrushFTP v10.8.5 and CrushFTP v11.3.4_23. It is unclear when these versions were released, but CrushFTP says around July 1st [1]. Enterprise customers using a DMZ CrushFTP instance to isolate their main server are not believed to be affected by this vulnerability. Accoring to CrushFTP: We believe this bug was in builds prior to July 1st time period roughly... the latest versions of CrushFTP already have the issue patched. The attack vector was HTTP(S) for how they could exploit the server. We had fixed a different issue related to AS2 in HTTP(S) not realizing that prior bug could be used like this exploit was. Hackers apparently saw our code change, and figured out a way to exploit the prior bug. Affected products CrushFTP version 10 below 10.8.5 CrushFTP version 11 below 11.3.4_23 Recommendations Check if you may have been compromised. IoC include [1]: your MainUsers/default/user.XML containslast_logins the modified date on your default user.XML is recent default user has admin access long random userid's created you don't recognise - example: 7a0d26089ac528941bf8cb998d97f408m other usernames recently created with admin access. buttons from the end-user web interface disappeared, and formerly regular user now has Admin button In case of compromise [1]: Restore a prior default user from your backup folder from before the exploit. ( /backup/users/MainUsers/default/.. ). You can also just delete your default user and CrushFTP will re-create it for you, but you won't have any prior customizations you might have done. Restore it to your /users/MainUsers/default Review upload/download reports for anything transferred. Hackers re-used scripts from prior exploits to deploy things on CrushFTP servers. We recommend restoring to July 16th time period just to avoid anything that might have been done.

CrushFTP: rilevato sfruttamento in rete della CVE-2025-54309 Alert AL04/250721/CSIRT-ITA Sintesi Rilevato lo sfruttamento attivo in rete di una vulnerabilità con gravità “critica” - già sanata dal vendor – presente in CrushFTP, software per il trasferimento sicuro di file. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un attaccante remoto di ottenere privilegi elevati sul sistema interessato. Tipologia Privilege Escalation Prodotti e versioni affette CrushFTP 10.x, versioni precedenti alla 10.8.5 11.x, versioni precedenti alla 11.3.4_23 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti interessati seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.