CrushFTP Zero-Day CVE-2024-4040 Exploited to Escape Sandbox and Steal Files

CrushFTP warned customers to patch an actively exploited zero-day, now tracked as CVE-2024-4040, that lets unauthenticated attackers escape the product’s virtual file system sandbox and download system files. The company said the flaw was reported and patched immediately, with fixes released in CrushFTP v10.7.1 and v11.1.0; organizations still running v9 were urged to upgrade to v11 or apply updates through the product dashboard. Airbus CERT also published a public scanner for the vulnerability on GitHub, underscoring rapid defender and researcher interest in identifying exposed systems.

CrowdStrike said the bug was exploited in the wild in targeted attacks against multiple U.S. organizations and assessed the activity as an intelligence-gathering campaign that was likely politically motivated. CrushFTP added that deployments using a DMZ in front of the main instance were protected from the observed attacks, while internet exposure remained a major concern: Shodan data cited in reporting showed roughly 2,700 CrushFTP instances with their web interface accessible online, expanding the pool of potentially vulnerable targets.