CISA Adds CrushFTP Vulnerability to KEV Catalog Following Confirmed Active Exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-2825 | A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257715. NVD description · AI analysis pending | 8.8 | <1% | PoC |
| — | |
| CVE-2025-2825 | Rejected reason: DO NOT USE THIS CVE RECORD. Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2025-31161. Reason: This Record is a reservation duplicate of CVE-2025-31161. Notes: All CVE users should reference CVE-2025-31161 instead of this Record. All references and descriptions in this Record have been removed to prevent accidental usage. NVD description · AI analysis pending | — | — | — | — | ||
| CVE-2025-31161 | Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161) CrushFTP contains an authentication bypass (CWE-305) in its handling of the HTTP authorization header, allowing crafted header values to grant access without valid credentials. A remote, unauthenticated attacker who can reach the server's HTTP/HTTPS interface can use this flaw to authenticate as any known or guessable account, such as the built-in crushadmin user. With administrative access, the attacker can typically achieve full compromise of the file-transfer server, including access to hosted files and user accounts. Any organization running CrushFTP is affected, with internet-exposed instances at the highest risk. The flaw is being actively exploited: it was added to CISA's KEV on 2025-04-07 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Upgrade to the vendor's fixed releases (10.8.0 for the 10.x line and 11.3.1 for the 11.x line, per vendor advisories); federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Until patched, restrict network access to the CrushFTP HTTP/HTTPS interface and audit authentication logs for unexpected logins to privileged accounts such as crushadmin. Given confirmed ransomware use, treat internet-exposed instances as actively targeted and verify there are no signs of prior compromise after patching. | 9.8 | 100% | KEV ransomware PoC ×4 |
| moderate≈5,000–10,000 internet-exposed CrushFTP servers (public scan counts), with additional uncounted internal enterprise deployments |
Full article779 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 08, 2025Cyber Attack / Vulnerability
A recently disclosed critical security flaw impacting CrushFTP has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog after reports emerged of active exploitation in the wild.
The vulnerability is a case of authentication bypass that could permit an unauthenticated attacker to take over susceptible instances. It has been fixed in versions 10.8.4 and 11.3.1.
"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise," CISA said in an advisory.
The shortcoming has been assigned the CVE identifier CVE-2025-31161 (CVSS score: 9.8). It bears noting that the same vulnerability was previously tracked as CVE-2025-2825, which has now been marked Rejected in the CVE list.
The development comes after the disclosure process associated with the flaw has been entangled in controversy and confusion, with VulnCheck – due to it being a CVE Numbering Authority (CNA) – assigned an identifier (i.e., CVE-2025-2825), while the actual CVE (i.e., CVE-2025-31161) had been pending.
Outpost24, which is credited with responsibly disclosing the flaw to the vendor, has stepped in to clarify that it requested a CVE number from MITRE on March 13, 2025, and that it was coordinating with CrushFTP to ensure that the fixes were rolled out within a 90-day disclosure period.
However, it wasn't until March 27 that MITRE assigned the flaw the CVE CVE-2025-31161, by which time VulnCheck had released a CVE of its own without contacting "CrushFTP or Outpost24 beforehand to see if a responsible disclosure process was already underway."
VulnCheck, for its part, has criticized MITRE for rejecting CVE-2024-2825 and publishing CVE-2025-31161 instead, while also accusing CrushFTP of attempting to cover up the vulnerability.
"CrushFTP, LLC released an advisory but deliberately requested that a CVE not be issued for 90-days, effectively trying to hide the vulnerability from the security community and defenders," VulnCheck security researcher Patrick Garrity said in a post on LinkedIn.
"What's worse is that MITRE appears to have prioritized their involvement in the write-up over the timely disclosure of a vulnerability that was actively being exploited in the wild. This sets a dangerous precedent."
The Swedish cybersecurity company has since released step-by-step instructions to trigger the exploit without sharing much of the technical specifics -
- Generate a random alphanumeric session token of a minimum 31 characters of length
- Set a cookie called CrushAuth to the value generated in step 1
- Set a cookie called currentAuth to the last 4 characters of the value generated in step 1
- Perform an HTTP GET request to the target /WebInterface/function/ with the cookies from steps 2 and 3, as well as an Authorization header set to "AWS4-HMAC=<username>/," where <username> is the user to be signed in as (e.g., crushadmin)
A net result of these actions is that the session generated at the start gets authenticated as the chosen user, allowing an attacker to execute any commands that user has rights to.
Huntress, which re-created a proof-of-concept for CVE-2025-31161, said it observed in-the-wild exploitation of CVE-2025-31161 on April 3, 2025, and that it uncovered further post-exploitation activity involving the use of MeshCentral agent and other malware. There is some evidence to suggest that the compromise may have happened as early as March 30.
The cybersecurity firm said it has seen exploitation efforts targeting four distinct hosts from four different companies to date, adding three of those affected were hosted by the same managed service provider (MSP). The names of the impacted companies were not disclosed, but they belong to marketing, retail, and semiconductor sectors.
The threat actors have been found to weaponize the access to install legitimate remote desktop software such as AnyDesk and MeshAgent, while also taking steps to harvest credentials in at least one instance.
After deploying MeshAgent, the attackers are said to have added a non-admin user ("CrushUser") to the local administrators group and delivered another C++ binary ("d3d11.dll"), an implementation of the open-source library TgBot.
"Tt is likely that the threat actors are making use of a Telegram bot to collect telemetry from infected hosts," Huntress researchers said.
As of April 6, 2025, there are 815 unpatched instances vulnerable to the flaw, with 487 of them located in North America and 250 in Europe. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary patches by April 28 to secure their networks.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/cisa-adds-crushftp-vulnerability-to-kev.html