CrushFTP Authentication Bypass Vulnerability Discovered

What changed

A significant vulnerability has been discovered in CrushFTP that allows for authentication bypass, potentially leading to account takeover. This flaw affects versions 10 prior to 10.8.4 and 11 prior to 11.3.1, and has been actively exploited in the wild during early 2025.

The issue arises from a race condition in the AWS4-HMAC authorization method used by the HTTP component of the FTP server, which can allow unauthorized session authentication.

Who is affected

Organizations using CrushFTP versions 10 before 10.8.4 and 11 before 11.3.1 are at risk of this vulnerability. The following groups should take note:

System administrators and security teams managing CrushFTP installations need to be aware of this vulnerability to protect their environments.

• CrushFTP users on versions 10 and 11 prior to the specified updates.
• Organizations relying on CrushFTP for secure file transfer services.
• IT departments responsible for maintaining server security and user access controls.

What to do

Immediate action is required to mitigate the risks associated with this vulnerability. Users should prioritize updating their CrushFTP installations to the latest versions to ensure protection against this flaw.

In addition, organizations should review their access controls and monitor for any unauthorized access attempts to the crushadmin account.

• Upgrade to CrushFTP version 10.8.4 or 11.3.1 or later as soon as possible.
• Implement additional security measures, such as DMZ proxy instances, to further protect against unauthorized access.
• Conduct a security audit to identify any potential breaches or unauthorized access related to this vulnerability.