PT-2025-12973 · Crushftp · Crushftp

Outpost24 · Publicado 2025-03-13 · Atualizado 2025-12-05 · CVE-2025-2825

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CrushFTP versions 10.0.0 through 10.8.3 CrushFTP versions 11.0.0 through 11.3.0

Description The vulnerability in CrushFTP is related to improper authentication, allowing remote and unauthenticated HTTP requests to gain unauthorized access. This can be exploited to impersonate a user, conduct administrative actions, and retrieve data. Over 1,500 servers are at risk, with attackers actively exploiting this flaw. Technical details include the use of S3-style headers to bypass authentication.

Recommendations For CrushFTP versions 10.0.0 through 10.8.3, update to version 10.8.4 or later. For CrushFTP versions 11.0.0 through 11.3.0, update to version 11.3.1 or later. As a temporary workaround, consider restricting access to the vulnerable HTTP(S) ports until a patch is applied.

Exploit

Correção

RCE

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-305

Identificadores relacionados

BDU:2025-03507

BDU:2025-03886

CVE-2025-2825

Produtos afetados

Crushftp

Referências · 160

• 🔥 https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis · Exploit
• 🔥 https://projectdiscovery.io/blog/crushftp-authentication-bypass · Exploit
• 🔥 https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2025/CVE-2025-2825.yaml · Exploit
• https://twitter.com/SebastianDAlex/status/1910655721860923732 · Publicação no Twitter
• https://twitter.com/bjgreenberg/status/1907955560323965274 · Publicação no Twitter
• https://twitter.com/qualys/status/1907616565303894251 · Publicação no Twitter
• https://twitter.com/CCBalert/status/1905290976064643334 · Publicação no Twitter
• https://twitter.com/Parth_Malhotra/status/1905596875320795599 · Publicação no Twitter
• https://crushftp.com/crush11wiki/Wiki.jsp?page=Update · Aviso do Fabricante
• https://twitter.com/ajnurcs/status/1906810251774492822 · Publicação no Twitter
• https://twitter.com/hackplayers/status/1907078020633923667 · Publicação no Twitter
• https://twitter.com/adriananglin/status/1906614871535312958 · Publicação no Twitter
• https://twitter.com/emgeekboy/status/1905593768117764517 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1920270618857025794 · Publicação no Twitter
• https://twitter.com/UndercodeUpdate/status/1918889420008165885 · Publicação no Twitter