CVE-2025-31161

CrushFTP Authentication Bypass Vulnerability

Crushftp

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no…

3. Apr 2025

Ausgewertete Quellen

• Hersteller
  https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo
• Hinweis
  https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
• Hinweis
  https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
• Hinweis
  https://projectdiscovery.io/blog/crushftp-authentication-bypass
• Hinweis
  https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
• Hinweis
  https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability
• Hinweis
  https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161
• CISA
  CrushFTP Authentication Bypass Vulnerability
• NVD
  CVE-2025-31161