Actively exploited · Published Apr 22, 2024 · Assigned by directcyber
CVE-2024-4040Unauthenticated arbitrary file read and remote code execution in CrushFTP
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in CrushFTP from CrushFTP. Attackers are actively exploiting it in the wild (listed by CISA on April 24, 2024). The chance it is exploited in the next 30 days is estimated at 99.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by May 1, 2024.
Official description
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Affected products (as reported)
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update vendor-advisory
- https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update vendor-advisory
- https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/ related
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ media-coverage
- https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/ third-party-advisory
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ third-party-advisory
- https://github.com/airbus-cert/CVE-2024-4040 exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040 government-resource