CrushFTP Vulnerability Could Expose Hosted Files and Enable Arbitrary Code Execution
Summary
CVE-2023-43117 affects CrushFTP versions before 10.5.2 and could expose hosted files or enable arbitrary file execution. Huntress says no evidence of exploitation was available and recommends patching and hardening MFT systems.
Key points
- CVE-2023-43117 affects CrushFTP versions earlier than 10.5.2 across Windows, macOS, and Linux.
- Exploitation could provide access to hosted files and arbitrary file execution, potentially enabling system takeover and data exfiltration.
- CrushFTP released a patch in August 2023; the vulnerability was publicly disclosed on November 16, 2023.
- Huntress reported no evidence that attackers had exploited the vulnerability at the time of its analysis.
- Automatic updates are disabled by default, so administrators may need to apply updates manually.
- Huntress recommends changing the default password algorithm to Argon and using Limited Server mode.
- Additional MFT defenses include restricting external access, applying hardened configurations, and monitoring endpoints and networks for exploitation or data exfiltration.
Article Details
- Affected Versions
- CrushFTP versions prior to 10.5.2
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Change the default CrushFTP application password algorithm to the Argon setting.
- Run CrushFTP in Limited Server mode.
- Restrict access to the application, for example by requiring a VPN or allow-listing known partners and entities.
MITRE ATT&CK
CVE
Threat Actors
Products
CrushFTPMFT vulnerability was identified by Converge Technology Solutions, originally in August 2023 impacting CrushFTP. Following responsible disclosure to the vendor, the vulnerability was publicly disclosed on NovemberProgress MOVEit Transferas targets in their own right for data exfiltration for extortion. The latter was directly observed with MoveIT exploitation, where the cl0p criminal group rapidly exploited thousands of exposed MoveIT instances to