CrushFTP Authentication Bypass Enables Unauthenticated Logins and Active Exploitation

A critical CrushFTP authentication bypass flaw, initially tracked as CVE-2025-2825 and later re-tracked as CVE-2025-31161, allows unauthenticated remote attackers to log in as valid users by sending a crafted S3-compatible Authorization header. The bug affects versions 10.0.0–10.8.3 and 11.0.0–11.3.0, and stems from flawed authentication logic in loginCheckHeaderAuth() that can skip password verification when processing AWS4-HMAC-style credentials. Researchers reported that an attacker may need only a username in the Credential field and a syntactically valid CrushAuth cookie format, without successful signature validation, to gain unauthorized access.

Security teams reported active exploitation against internet-exposed CrushFTP servers, with Shadowserver observing dozens of attack attempts in the wild. CrushFTP addressed the issue in 10.8.4 and 11.3.1, including changes to properly validate passwords and a default-disabled setting to block the vulnerable path; defenders were urged to upgrade immediately, restrict external access, or enable DMZ mode where patching is not yet possible. ProjectDiscovery also released a Nuclei detection template that checks for successful user-list retrieval via the bypass, underscoring the need to identify exposed and vulnerable instances quickly.