CVE-2025-54309: 
CrushFTP vulnerability analysis and mitigation

CVE-2025-54309 is a critical authentication bypass vulnerability in CrushFTP, an enterprise managed file transfer server, that allows unauthenticated remote attackers to obtain administrative access via HTTPS. The flaw stems from improper handling of AS2 validation when the DMZ proxy feature is not in use. It affects CrushFTP version 10 before 10.8.5 and version 11 before 11.3.4_23. Active exploitation was first detected on July 18, 2025, and the CVE was published the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, CISA KEV).

The vulnerability is classified as CWE-420 (Unprotected Alternate Channel). CrushFTP's web interface mishandles AS2 protocol validation over HTTP(S), creating an unprotected alternate channel that bypasses authentication controls. According to CrushFTP's CEO, a prior code change had inadvertently blocked this attack vector while targeting a different AS2-related issue; threat actors reverse-engineered the software, identified the underlying flaw, and began exploiting it on unpatched systems. The attack requires no authentication, no user interaction, and operates over the network via HTTPS, making it trivially exploitable at scale. Multiple public proof-of-concept exploits are available on GitHub (BleepingComputer, watchTowr Labs).

Successful exploitation grants an unauthenticated attacker full administrative access to the CrushFTP server, enabling complete control over the file transfer service and all data it manages. Attackers can read, modify, or exfiltrate any files stored on or accessible through the server, create or modify admin accounts for persistent access, and potentially pivot to other internal systems. Given that managed file transfer platforms are high-value targets for ransomware and data extortion campaigns — historically exploited by groups such as Clop — the risk of mass data theft and extortion is significant. Over 1,000 CrushFTP servers were reported exposed to ongoing hijack attacks, with government and healthcare networks among those targeted (BleepingComputer, Rapid7).

CVE-2025-54309 was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on July 22, 2025, with a remediation due date of August 12, 2025, confirming active in-the-wild exploitation (CISA KEV). Exploitation was first observed on July 18, 2025, and continued through at least late August 2025, with brute-force scanning activity reported as late as March 2026. Multiple public PoC exploits are available on GitHub from researchers including watchTowr Labs, foregenix, and others (watchTowr Labs, foregenix). The EPSS score is approximately 0.067, though real-world exploitation activity significantly exceeds what this score suggests. The vulnerability has been linked to Clop ransomware group tactics based on threat intelligence associations, consistent with that group's history of targeting managed file transfer platforms (BleepingComputer).

1. Reconnaissance: Identify internet-facing CrushFTP instances running versions below 10.8.5 or 11.3.4_23 using tools like Shodan, Censys, or FOFA, searching for CrushFTP web interface banners on HTTPS ports.
2. Identify target configuration: Confirm the target does not use a DMZ proxy in front of the main CrushFTP instance, as DMZ-protected deployments may not be directly exploitable via this vector.
3. Craft malicious AS2 request: Send a specially crafted HTTP(S) request to the CrushFTP web interface that exploits the improper AS2 validation logic, bypassing authentication controls via the unprotected alternate channel (CWE-420).
4. Obtain admin session: The server processes the malicious request and grants the attacker an authenticated administrative session without requiring valid credentials.
5. Establish persistence: Modify the default user configuration (MainUsers/default/user.XML) or create a new admin-level account (e.g., a username resembling 7a0d26089ac528941bf8cb998d97f408m) to maintain persistent access.
6. Exfiltrate data or deploy payloads: Use the administrative access to browse and download sensitive files, review upload/download logs, or deploy additional malware for lateral movement or ransomware deployment (BleepingComputer, watchTowr Labs).

• File System: Unexpected modifications to MainUsers/default/user.XML, particularly a last_logins field set for the internal default user account; presence of new, unrecognized admin-level usernames (e.g., 7a0d26089ac528941bf8cb998d97f408m).
• Logs: CrushFTP access logs showing unusual HTTPS requests targeting AS2-related endpoints from external IPs; unexpected administrative login events, especially from unknown IP addresses; anomalous upload or download activity in transfer logs.
• Network: Inbound HTTPS requests to the CrushFTP web interface with malformed or unexpected AS2 headers from external sources; outbound connections from the CrushFTP server to unknown external IPs (potential C2 or exfiltration).
• Process/Behavioral: Unexpected creation of new admin accounts or modification of existing user configurations; changes to server settings or access control lists not initiated by known administrators (BleepingComputer, Rapid7).

The primary remediation is to upgrade CrushFTP immediately: version 10.x users should update to 10.8.5 (or later, e.g., 10.8.5_12), and version 11.x users should update to 11.3.4_23 (or later, e.g., 11.3.4_26). CISA's due date for federal agencies was August 12, 2025. As a temporary measure, CrushFTP recommends enabling IP whitelisting for server and admin access and enabling automatic updates. While CrushFTP initially suggested that DMZ proxy deployments may not be affected, Rapid7 advises against relying on DMZ as a mitigation strategy due to uncertainty about its effectiveness. Organizations that suspect compromise should restore the default user configuration (MainUsers/default/user.XML) from a backup dated before July 16, 2025, and review all admin accounts for unauthorized additions (Rapid7, CISA KEV, CrushFTP Advisory).

CrushFTP CEO Ben Spink provided direct commentary to BleepingComputer, explaining that a prior code fix had inadvertently blocked the vulnerability and that attackers reverse-engineered the software to discover and exploit the underlying flaw. Rapid7 issued an emergent threat response advisory urging immediate patching and explicitly cautioning against relying on DMZ as a mitigation. CERT-EU, the Canadian Centre for Cyber Security, Belgium's CCB, Ireland's NCSC, and the UK's NHS Digital all issued advisories. Forbes, The Hacker News, SC World, BankInfoSecurity, and Infosecurity Magazine covered the story widely. Security researchers on Mastodon, Bluesky, and LinkedIn highlighted the vulnerability's severity and the speed of exploitation, with the Shadowserver Foundation reporting on exposed server counts. The watchTowr Labs technical write-up published in late August 2025 generated significant community discussion on Reddit's r/netsec (BleepingComputer, Rapid7, watchTowr Labs).