Overview
In the evolving world of cybersecurity, vulnerabilities are discovered and exploited every day. A recent vulnerability has been identified in CrushFTP versions 10 and 11, before specific patches, which has potentially devastating effects. This vulnerability, known as CVE-2025-54309, is particularly dangerous as it allows remote attackers to gain administrative access to the system through HTTPS, providing full control and potential for significant data breaches. This vulnerability has been exploited in the wild, making it an immediate concern for all users of the affected versions of CrushFTP.
Vulnerability Summary
CVE ID: CVE-2025-54309
Severity: Critical (9.0 on CVSS scale)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potentially complete system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
CrushFTP | 10.0 to 10.8.4
CrushFTP | 11.0 to 11.3.4_22
How the Exploit Works
This vulnerability arises from an oversight in the AS2 validation process in CrushFTP. When the DMZ proxy feature is not used, the application mishandles AS2 validation, consequently allowing remote attackers to obtain admin access via HTTPS. This exploit does not require any user interaction or any special privileges, making it a severe and easily exploitable vulnerability.
Conceptual Example Code
While the exact exploitation method is not disclosed to prevent misuse, a conceptual example might involve a malicious HTTPS request that takes advantage of the flawed AS2 validation. This request could look similar to this:
POST /admin_login HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
username=admin&password=not_really_a_password&as2_validation=malicious_payloadIn the example above, the `as2_validation` parameter is manipulated with a ‘malicious_payload’ that exploits the AS2 validation vulnerability, granting admin access to the attacker.
Mitigation Guidance
The recommended mitigation for this vulnerability is to apply the vendor-provided patches (CrushFTP 10.8.5 or CrushFTP 11.3.4_23). If it’s not possible to apply these patches immediately, using a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can provide temporary mitigation. However, these are not full-proof solutions and the patch should be applied as soon as possible to prevent potential system compromise or data leakage.