Overview
CVE-2025-54309 is a critical security vulnerability in the CrushFTP Managed File Transfer Server, allowing unauthenticated remote attackers to completely bypass authentication and gain administrator-level access to the web interface. The vulnerability is actively being exploited (“in the wild”), making immediate patching essential.
Technical Summary
- Vulnerability Type: Authentication Bypass via Improper Validation
- Attack Vector: Remote (HTTP/HTTPS requests targeting WebInterface)
- CVE ID: CVE-2025-54309
- CVSS Score: Estimated 9.8 (Critical) [unofficial]
Affected Products and Versions
- All versions before 10.8.5_1210.8.5_12
- All versions before 11.3.4_2611.3.4_26
Even systems running previous patch levels (e.g., 10.8.5 or 11.3.4) are vulnerable unless the _12 or later suffix is present for those minor versions.
Root Cause Analysis
- The vulnerability stems from a flawed AS2 authentication mechanism, particularly when the DMZ Proxy feature is disabled.
- AS2 (Applicability Statement 2) is a protocol used to securely transfer files between systems via HTTPS. In CrushFTP, it is often used in business-to-business file exchanges.
- The issue relates to how the server processes authentication headers and user validation in some specific request workflows. If the DMZ proxy is not enabled, an attacker can craft specific requests using known mechanisms to trick the server’s input validation and gain elevated access.
Exploitation Details
- Status: Confirmed exploited in the wild (zero-day)
- Date of discovery: July 18, 2025 (public disclosure)
- Earliest observed use in the wild: July 16, 2025 (estimate via forensic analysis)
- Attackers have reverse-engineered the CrushFTP application and modified older exploit scripts tied to legacy bugs to take advantage of this issue.
- Exploits target the “default” admin account, attempting to:
- Add new administrative accounts
- Modify existing configuration files
- Upload remote access shells or agents
- Exfiltrate sensitive file data
Impact
- Confidentiality: Compromised – attackers can view, download, or steal sensitive files
- Integrity: Compromised – attackers can modify user accounts and settings
- Availability: Possible service disruption or sabotage from admin-level access
Mitigation and Remediation
Update Immediately:
- Upgrade to CrushFTP 10.8.5_12 or 11.3.4_26
- Available from the CrushFTP update page
- The patch fully disables the vulnerable code paths in the AS2 validation logic
Post-Incident Response Checklist:
- Check for any changes to:
users/MainUsers/default.XML- New or unexpected entries in the
users/MainUsers/directory - Review server and application logs for:
- Unusual login attempts
- Unfamiliar API activity from foreign IPs
- Perform a full audit of all admin-level credentials and privileges
- Reset administrative passwords
- Rebuild compromised configurations from trusted backups prior to July 16, 2025
Optional (but Recommended):
- Review and limit internet access to the CrushFTP UI if not required
- Monitor for unusual network activity or file transfer spikes
- Consider enabling 2FA (Two-Factor Authentication) if supported
Additional Notes & Vendor Response:
- This issue is related but distinct from older AS2-related vulnerabilities in CrushFTP. A cleanup patch issued by the vendor on July 1, 2025, for unrelated reasons incidentally eliminated this new weakness in newer builds — which helped identify and triage the issue quickly.
- The vendor issued an emergency patch within days of disclosure and has posted a step-by-step mitigation guide (link).
Internet Exposure
- As of July 2025, scanning tools (e.g., Censys, Shodan) reported:
- ~250,000–300,000 CrushFTP instances externally visible
- Unknown percentage still unpatched
- Many of these are in government, healthcare, legal, and financial sectors—meaning the damage potential is significant.
