PT-2023-6955 · Crushftp · Crushftp
Ryan Emmons
·
Published
2023-11-16
·
Updated
2025-11-15
·
CVE-2023-43177
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
CrushFTP versions prior to 10.5.1
Description
The issue is related to errors in handling input data in the Object Attribute Handler component of the CrushFTP cross-platform FTP server. Exploitation of this issue may allow a remote attacker to execute arbitrary code by sending specially crafted requests containing AS2 headers. The vulnerability is associated with improper handling of AS2 headers in CrushFTP, allowing an attacker to gain control over user information Java Properties, set arbitrary permissions for reading and deleting files, and potentially lead to system compromise and remote code execution at the root level. It is estimated that thousands of organizations are threatened by this issue, with about 46,088 results mainly distributed in the United States, Germany, and other countries.
Recommendations
For CrushFTP versions prior to 10.5.1, update to version 10.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the AS2 functionality to minimize the risk of exploitation. Additionally, monitor server activity related to AS2, as any such activity should raise immediate suspicions as a potential precursor to an attack.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Crushftp