Critical · published April 3, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 An authentication bypass in CrushFTP could let an attacker waltz right into the crushadmin account—no password required! 🔥 Think of this vulnerability as a restaurant with a notoriously easy entry—anyone can just walk in, grab a seat, and start ordering without ever checking in with the host. In this case, the FTP server is the restaurant, and the race condition is the open door that lets anyone claim a table without a reservation. This vulnerability could lead to an absolute nightmare where an attacker fully compromises your server by accessing the administrative account. Imagine someone turning off the lights, messing with your settings, or even stealing sensitive data—all because they could waltz in without a proper key. The consequences could be devastating, especially with known exploitation in the wild as recent as March and April 2025!
Think of this vulnerability as a restaurant with a notoriously easy entry—anyone can just walk in, grab a seat, and start ordering without ever checking in with the host. In this case, the FTP server is the restaurant, and the race condition is the open door that lets anyone claim a table without a reservation. The flaw arises from a race condition in the AWS4-HMAC authorization method, allowing attackers to authenticate as any user by simply sending a specially crafted request. When the server checks for user verification, it gets caught in a loop that permits unauthorized access without a password requirement.
This vulnerability could lead to an absolute nightmare where an attacker fully compromises your server by accessing the administrative account. Imagine someone turning off the lights, messing with your settings, or even stealing sensitive data—all because they could waltz in without a proper key. The consequences could be devastating, especially with known exploitation in the wild as recent as March and April 2025! Immediate action is crucial! Upgrade CrushFTP to version 10.8.4 or 11.3.1 to patch this critical vulnerability. Make sure to review your configuration and consider using a DMZ proxy instance to secure your environment further. 🛡️ You’ve got this! Follow these steps to secure your server, and you’ll be back in control in no time! 💪✨