CVE-2024-4040

Successful exploitation can compromise the confidentiality, integrity, and availability of the CrushFTP server. Attackers can access and exfiltrate files outside configured VFS restrictions, obtain administrative access, and execute arbitrary code. Arbitrary file reads as root have been demonstrated; effective operating-system access depends on the privileges of the CrushFTP process. Administrative access and code execution can lead to full server compromise.

Until patched, tightly restrict network access to CrushFTP services using firewall allowlists, particularly access to the HTTP/S web interface. Deployments exposing only SFTP are not reachable through this web-interface exploit path. Enable Limited Server mode with the most restrictive practical configuration to reduce administrator-level code-execution opportunities. Do not rely on a DMZ deployment or reverse proxy as a complete mitigation. Monitor for suspicious file access and administrative activity, recognizing that evasive payloads may be redacted from logs and that a lack of logged evidence does not establish absence of exploitation.

Upgrade CrushFTP 10.x to version 10.7.1 or later, or CrushFTP 11.x to version 11.1.0 or later; preferably deploy the latest supported release. Migrate legacy 9.x installations to a supported, patched release. Treat patching as an emergency because exploitation is confirmed in the wild. Investigate potentially exposed systems for prior compromise, since installing the patch does not remove attacker access or reverse earlier data theft.