Loading vulnerability…
CrushFTP S3 Header Authentication Bypass
CVE-2025-2825 is a rejected duplicate of CVE-2025-31161; the latter is the canonical identifier for this vulnerability. The flaw affects CrushFTP versions 10.0.0–10.8.3 and 11.0.0–11.3.0. Improper authentication in the ServerSessionHTTP class's loginCheckHeaderAuth() method allows a crafted AWS4-HMAC Authorization header to bypass password verification. The vulnerable flow extracts a username from the S3 Credential field and enables a password-check bypass when the expected tilde delimiter is absent. Subsequent authentication logic can accept the matching account despite an empty or incorrect password. A remote, unauthenticated attacker who knows a valid username can impersonate that account, including an administrator. The vulnerability is rated critical, with a reported CVSS score of 9.8, and has been exploited in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality and integrity of resources accessible to the impersonated account. Impersonating an administrator enables administrative access, disclosure of user lists and account details, access to server data, and creation of additional accounts for persistent access. Attackers can use resulting account privileges to upload malicious files, potentially facilitating malware or ransomware deployment. Administrative access depends on targeting an administrator username; the bypass itself does not establish arbitrary operating-system code execution.
If you can’t patch tonight, do this now.
If immediate upgrading is not possible, enable the CrushFTP DMZ proxy option, which was recommended as a mitigation for this authentication bypass. Treat this as a temporary measure rather than a replacement for patching.
Patch, then assume compromise.
Upgrade CrushFTP 10.x to version 10.8.4 or later, or CrushFTP 11.x to version 11.3.1 or later. Track patching and vulnerability management under CVE-2025-31161 rather than the rejected duplicate CVE-2025-2825. Because exploitation has occurred in the wild, assess exposed installations for unauthorized accounts and administrative activity; patching alone does not remove access already established by an attacker.
7 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.