CrushFTP CVE-2024-4040 Exploited in the Wild, Enables Unauthenticated Remote Code Execution
Summary
CVE-2024-4040 affects CrushFTP versions before 10.7.1 and 11.1.0. Researchers report unauthenticated remote code execution and in-the-wild exploitation; users should upgrade. The flaw is exploitable through the web interface, not SFTP-only exposure.
Key points
- The vulnerability affects CrushFTP 9.x before 10.7.1 and 11.0 before 11.1.0.
- Though initially described as a low-privilege VFS sandbox escape and arbitrary file read, researchers found it can enable unauthenticated remote code execution and administrator authentication bypass.
- The article says exploitation has been observed in the wild; a proof of concept demonstrating sandbox escape has also been published.
- The flaw is exploitable through the web interface port; setups exposing only SFTP are described as safe.
- Upgrade to CrushFTP 10.7.1 or 11.1.0. Earlier guidance that a DMZ could protect users was retracted.
- Wiz reports vulnerable instances in 1.7% of cloud environments and internet-exposed CrushFTP instances in 0.4%.
Article Details
- Vulnerability Types
- VFS sandbox escape
- Arbitrary file read
- Server-side template injection (SSTI)
- Authentication bypass
- Unauthenticated remote code execution
- Severity
- CVSS 9.8
- Affected Versions
- CrushFTP 9.x before 10.7.1
- CrushFTP 11.0 before 11.1.0
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Systems exposing only the SFTP port are considered safe because the CVE is exploitable only through the web interface port.