Cyberstorm Alert: CrushFTP Security Breach Puts Sensitive Transfers at Risk

Cyberstorm Alert: CrushFTP Security Breach Puts Sensitive Transfers at Risk

Summary

Critical vulnerability: An authentication bypass in CrushFTP, tracked as CVE-2025-31161 (also published as CVE-2025-2825), lets attackers take over unpatched servers. Active exploitation has been reported. Affected versions are 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0. Patch to 10.8.4 or 11.3.1 or later now.

What Went Wrong at CrushFTP

CrushFTP, a file transfer server used by businesses to share files over FTP, SFTP, HTTPS and other protocols, has a critical flaw that attackers are already exploiting. The bug, rated 9.8 on the CVSS scale, lets a remote attacker log in as any known or guessable user, including the default “crushadmin” administrator account, without a password. Outpost24 said more than 1,500 vulnerable instances were exposed online.

How the Authentication Bypass Works

Outpost24 analysts discovered the vulnerability and requested a CVE from MITRE on March 13, 2025. The flaw sits in CrushFTP’s handling of the HTTP Authorization header for AWS4-HMAC-SHA256 authentication, which is meant for Amazon services. Versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected, and MITRE assigned it CVE-2025-31161.

The server briefly authenticates a supplied username before checking the password. Normally that would be a narrow race condition. But sending a mangled Authorization header makes the request fail before the session is cleaned up, leaving the attacker logged in as the chosen user. With an administrator account, that means full control of the server.

A Messy Disclosure, Then Attacks

Outpost24 had agreed with CrushFTP on a 90-day disclosure window so customers could patch quietly. On March 26, VulnCheck published a separate CVE for the same bug, CVE-2025-2825, without coordinating with either company. Details and proof-of-concept code spread within days, and attackers began exploiting unpatched servers.

File transfer products are a favorite target of ransomware gangs, which makes the flaw especially dangerous. CISA added it to its Known Exploited Vulnerabilities catalog on April 7, 2025.

How to Patch

CrushFTP released patches and emailed customers on March 21, 2025. “Please take immediate action to patch ASAP,” the company warned, adding that an exposed HTTP(S) port could lead to unauthenticated access.

Update to version 10.8.4 or 11.3.1 or later. If you cannot patch right away, enabling CrushFTP’s DMZ perimeter network option can serve as a temporary workaround.

Steps Beyond Patching

Patching closes the hole. It doesn’t tell you whether someone got in first. Useful steps include:

Review CrushFTP logs and admin accounts for unfamiliar logins or new users. Rename or disable the default crushadmin account and use strong, unique admin names and passwords. Restrict internet access to the admin interface wherever possible.

File transfer servers hold exactly the data attackers want. Keeping them off the open internet, or behind a gateway, limits the damage from the next flaw.

The Takeaway

CVE-2025-31161 is easy to exploit and gives attackers admin access. Check your version today.

The botched disclosure is also a lesson. Once details leak, the window between publication and attack can be a matter of days.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.