CrushFTP, a widely used MFT and file server, was targeted through authentication-bypass and input-handling flaws in its web interface. An unauthenticated attacker reaching the exposed interface could trigger the bypass to reach administrative functionality and read files, in some variants including server-side files beyond the intended user scope. That exposed the appliance configuration, stored credentials, and the brokered data, and the admin access chained toward code execution in some cases.
# fingerprint CrushFTP and reach the web interface
curl -skI https://<target>:<port>/ # CrushFTP headers/banner
curl -sk https://<target>:<port>/ -i | grep -i crushftp
# the exploit triggers the auth bypass to reach admin/file functions; match the
# CrushFTP build to the advisory for the specific bypass and the reachable function.
Exploitation notes#
- The entry is an unauthenticated bypass reaching admin or file-read functionality; exposure of the web interface is the precondition, and internet-facing instances were the compromised set.
- The file-read variants reach server-side files outside the intended user scope, so the payoff includes the appliance's own configuration and credentials, not only user data.
- Admin access escalates: from the administrative functions the path to code execution and full appliance control follows; see Authentication bypass.
- Fingerprint the CrushFTP build and match the advisory; the bypass and reachable function are version-specific.