CVE-2024-4040 CrushFTP VFS Sandbox Escape
Unauthenticated attackers can exploit server-side template injection to read files, bypass authentication, and execute arbitrary code on CrushFTP servers.
- Exploited in the wild
- Since 24 Apr 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4040?
CVE-2024-4040 is a critical code injection vulnerability in CrushFTP, published on 22 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Which versions are affected by CVE-2024-4040?
It affects 1 product.
Products include Crushftp Crushftp.
How do I fix CVE-2024-4040?
No fix has been published for CVE-2024-4040 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 1 May 2024.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-4040 being exploited?
Yes. Attackers have exploited CVE-2024-4040 in the wild since at least 24 Apr 2024.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 19 proofs of concept on GitHub.
Other vulnerabilities in CrushFTP
Sources
Also known as GHSA-46vf-c8gj-2pgq.