CrushFTP Authentication Bypass Exploited to Compromise Servers and Install Remote-Access Tools

Attackers exploited CVE-2025-31161, a critical authentication bypass in CrushFTP, to impersonate users and compromise internet-facing file-transfer servers. Rated CVSS 9.8, the flaw affects versions 10.0.0–10.8.3 and 11.0.0–11.3.0 and involves faulty HTTP AWS4-HMAC/S3 authorization processing. A malformed authorization header allows unauthenticated attackers to authenticate as a known or guessable user, including the administrator account, potentially enabling file access, code execution, and full server compromise. Exploitation was reported during March and April 2025; Huntress observed attacks by April 3, with possible testing as early as March 30.

Huntress documented compromises on five hosts at five companies, three served by the same MSP, with post-exploitation activity involving MeshAgent, AnyDesk, SimpleHelp, Cloudflare Tunnel, credential dumping, and backdoor accounts. FortiGuard warned that a public proof of concept increased the risk of broader exploitation and cited approximately 1,800 vulnerable internet-exposed instances in April 2025—a historical exposure count, not a current estimate. Organizations should upgrade to 10.8.4 or 11.3.1 or later, restrict internet exposure, and review accounts, credentials, and remote-access tooling for signs of compromise. The CVE record identifies use of a CrushFTP DMZ proxy instance as an exception to the affected configuration.