CrushFTP Under Fire: CISA KEV Catalog Sparks Urgency

A critical flaw in CrushFTP—CVE-2025-31161—has been officially added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, highlighting its active exploitation in the wild. This vulnerability allows unauthenticated attackers to bypass authentication and seize control of the crushadmin account. Now for those in the know will remember there already was a CVE released for this, CVE-2025-2825, which according to some was for dubious reasons rejected. You can read all about that on Patrick Garrity's blogpost. Below is a short article telling you all you need to know regarding this avoidable exploit.

Overview

CrushFTP versions prior to 10.8.4 and 11.3.1 are affected by CVE-2025-31161. The vulnerability allows an attacker to authenticate as any known or guessable user—including the privileged crushadmin—by manipulating the AWS4-HMAC header. Originally observed in the wild in March and April 2025, the flaw has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue urgent guidance for organizations to remediate the issue or disable exposure to untrusted networks.

Key vulnerability characteristics include:

Authentication Bypass: The attack leverages a logic flaw in user verification methods.
Race Condition Exploit: The vulnerability arises from the way CrushFTP verifies user existence before password requirements.
Severe Impact: The base CVSS score of 9.8 underscores the critical security impact, enabling full administrative takeover.

Technical Details

The core issue lies in the way CrushFTP handles AWS4-HMAC authorization during HTTP(S) access:

Initial User Verification: Upon receiving a request, the server calls the login_user_pass() function without enforcing a password requirement, thereby verifying the existence of the user.
Race Condition Emergence: The server then checks the user’s credentials a second time. By carefully triggering a race condition—exacerbated through a mangled AWS4-HMAC header—an attacker can manipulate the authentication flow.
Header Manipulation: By sending an AWS4-HMAC header that includes only the username followed by a slash (e.g., AWS4-HMAC=crushadmin/), the server successfully identifies the username but fails to locate the expected SignedHeaders entry. This discrepancy triggers an index-out-of-bounds error, effectively bypassing standard cleanup and verification routines.

Researchers have demonstrated that the exploit can be triggered using the following procedure:

Generate a Random Session Token: Create an alphanumeric string of at least 31 characters.
Set Cookies:
- CrushAuth is set to the full session token.
- currentAuth is set to the last 4 characters of this token.
Craft the HTTP Request: Issue an HTTP GET request to /WebInterface/function/ with the cookies above and include an Authorization header in the format:

AWS4-HMAC=<username>/

where <username> is the target account (e.g., crushadmin).

This sequence results in the session being authenticated as the chosen user, thereby granting full administrative access.

KEV Catalog Significance & Active Exploitation

The CISA KEV catalog entry signals that this vulnerability is not just theoretical but is actively exploited. Since late March 2025, threat actors have targeted CrushFTP installations, with over 815 compromised systems recorded globally—487 in North America and 250 in Europe. Attackers have:

Installed remote access tools like AnyDesk and MeshAgent.
Created persistent backdoor accounts.
Exfiltrated sensitive data.

The KEV listing underscores the urgency for organizations to patch immediately and reassess their security postures.

Mitigation and Recommendations

Patch Immediately: Upgrade to CrushFTP versions 10.8.4 or 11.3.1.
Network Isolation: In cases where immediate patching is unfeasible, deploy a DMZ proxy instance to limit exposure.
Adhere to CISA Guidance: Federal agencies should follow applicable BOD 22-01 guidance and secure their networks by the stipulated deadline.

Industry Reaction and Timeline

The unfolding events around CVE-2025-31161 have sparked debate within the cybersecurity community:

CISA KEV Addition: The vulnerability has been recently added to CISA’s Known Exploited Vulnerabilities (KEV) catalog following confirmed active exploitation, as reported by sources like The Hacker News.
Controversial Disclosure Process: Industry experts, including those from First.org, have criticized the delay in public disclosure and the withholding of the CVE for 90 days at the vendor’s request, arguing that this approach compromises the timely defense against active threats.
Broader Impact: With CrushFTP’s long history dating back to 1998 and its broad protocol support, the repercussions of this vulnerability extend far beyond a single product, emphasizing the need for enhanced security practices across legacy systems.

Conclusion

The inclusion of CVE-2025-31161 in the CISA KEV catalog is a serious alert for defenders. With active exploitation documented, immediate remedial actions are essential to secure systems against unauthorized admin takeovers. Staying current with patches and following robust network segmentation practices are critical in mitigating the risk posed by this flaw.

References

For the latest updates on this critical vulnerability and additional cybersecurity alerts, follow BaseFortify.eu on Twitter and LinkedIn. Or Register for free at https://basefortify.eu/register