Vulnerability DatabaseCVE-2023-43177

CVE-2023-43177:
CrushFTP vulnerability analysis and mitigation

Overview

CrushFTP prior to version 10.5.1 was discovered to contain a critical unauthenticated vulnerability (CVE-2023-43177) related to Improperly Controlled Modification of Dynamically-Determined Object Attributes. The vulnerability was discovered in August 2023 and affects approximately 10,000 public instances and numerous corporate installations. The vulnerability exists in the default configuration across all operating systems (Converge Blog).

Technical details

The vulnerability is a mass assignment vulnerability related to how CrushFTP parses request headers for the AS2 protocol. The attack chain primarily relies on an unauthenticated mass-assignment vulnerability in the header parsing logic, which allows attackers to gain partial control over user information Java Properties. This can be leveraged to establish arbitrary file read-and-delete capabilities on the host system. The vulnerability has received a CVSS v3.1 base score of 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (NVD, Converge Blog).

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to access all CrushFTP files, execute arbitrary programs on the host server, and acquire plain-text passwords. The exploit can lead to complete system compromise, including root-level remote code execution. Additionally, attackers can hijack user sessions and escalate privileges to administrator level (Converge Blog).

Mitigation and workarounds

The vulnerability has been patched in CrushFTP version 10.5.2. Recommended mitigation steps include: updating to the latest version, configuring automatic updates for security patches, setting the default password algorithm to Argon, auditing for unauthorized user accounts and recent password changes, enabling the new Limited Server mode, and configuring the most restrictive settings possible. Additional security measures include setting up a limited operating system service account, deploying a reverse proxy for public-facing instances, and implementing firewall rules to limit incoming traffic (Converge Blog).

Community reactions

The CrushFTP development team responded rapidly to the security researchers and issued a patch overnight at the beginning of August. They also introduced a new hardened Limited Server mode in response to researcher feedback (Converge Blog).