Critical · published April 22, 2024
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A single template injection is the key to a realm of chaos! Attackers can read files from your server and even gain admin access without breaking a sweat. 🔥 Think of this vulnerability as an unwatched kitchen where anyone can walk in and grab any ingredient they want, plus the recipe book that reveals all the secret dishes. It's an open invitation to create a feast of havoc! An attacker can exploit this vulnerability to read sensitive files from the server, gain full administrative access, and execute malicious code. This could lead to data theft, service disruption, or total server control — absolutely devastating results for any organization!
Think of this vulnerability as an unwatched kitchen where anyone can walk in and grab any ingredient they want, plus the recipe book that reveals all the secret dishes. It's an open invitation to create a feast of havoc! This server side template injection flaw in CrushFTP allows unauthenticated attackers to manipulate templates, enabling them to read files outside of the VFS Sandbox and execute arbitrary code on the server. All versions prior to 10.7.1 and 11.1.0 are affected across all platforms.
An attacker can exploit this vulnerability to read sensitive files from the server, gain full administrative access, and execute malicious code. This could lead to data theft, service disruption, or total server control — absolutely devastating results for any organization! Immediate action is needed! Upgrade CrushFTP to version 10.7.1 or 11.1.0 to close this vulnerability. Make sure to check configuration settings to restrict access further and conduct a security audit of your system. 🔒 You've got this! Follow these steps and you'll have your defenses up in no time. 🛡️