CrushFTP VFS Sandbox Escape Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-04-24
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 10.0

[ Description ]Official description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

CISA: CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 1 May 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Patch on crushftp.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on crushftp.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on reddit.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• github.com/airbus-cert/CVE-2024-4040ExploitThird Party Advisory
• www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day…Press/Media CoverageThird Party Advisory
• www.crushftp.com/crush10wiki/Wiki.jspPatchVendor Advisory
• www.crushftp.com/crush11wiki/Wiki.jspPatchVendor Advisory
• www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-compl…Third Party Advisory
• www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_v…ExploitIssue Tracking
• www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerableIssue TrackingPatch
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource