Critical · published July 18, 2025
CVSS calls it critical at 9.0. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A surprising oversight in CrushFTP is putting admin access at risk, and it’s so easy an attacker can exploit it through HTTPS! 🔥 Think of it like leaving your front door wide open while only using a flimsy screen door to keep intruders out — without the DMZ proxy feature, the real door is just sitting there, unguarded. An attacker could waltz right in and gain full admin access to your server — they could modify settings, steal sensitive data, or even bring your entire operation to a halt! This kind of breach is absolutely devastating, especially since it's already being exploited out in the wild.
Think of it like leaving your front door wide open while only using a flimsy screen door to keep intruders out — without the DMZ proxy feature, the real door is just sitting there, unguarded. This vulnerability arises due to improper handling of AS2 validation in CrushFTP versions up to 10.8.5 and 11.3.4_23 when the DMZ proxy feature isn't utilized. This allows remote attackers to bypass crucial security checks, gaining unauthorized administrative privileges.
An attacker could waltz right in and gain full admin access to your server — they could modify settings, steal sensitive data, or even bring your entire operation to a halt! This kind of breach is absolutely devastating, especially since it's already being exploited out in the wild. Immediately upgrade CrushFTP to version 10.8.5 or 11.3.4_23 and enable the DMZ proxy feature for added security. Regularly audit user access permissions and ensure that security settings are in place to mitigate the risk of exploitation. You’ve got this! Follow these steps, and you’ll lock down your system in no time! 🛡️