Back to KEVs

CVE-2024-4040

Unauthenticated arbitrary file read and remote code execution in CrushFTP

Basic Information

CVE State: PUBLISHED
Reserved Date: April 22, 2024
Published Date: April 22, 2024
Last Updated: February 04, 2025
Vendor: CrushFTP
Product: CrushFTP
Description: A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2024-04-24 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2024-05-13 17:33:36 UTC) Source

References

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/ https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/ https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ https://github.com/airbus-cert/CVE-2024-4040

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-04-24 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4040.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

entroychang/CVE-2024-4040

Type: github • Created: 2024-07-05 05:46:56 UTC • Stars: 3

CVE-2024-4040 PoC

1ncendium/CVE-2024-4040

Type: github • Created: 2024-05-13 17:33:36 UTC • Stars: 0

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

gotr00t0day/CVE-2024-4040

Type: github • Created: 2024-05-03 23:29:53 UTC • Stars: 8

jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability

Type: github • Created: 2024-05-01 14:42:39 UTC • Stars: 3

Mohammaddvd/CVE-2024-4040

Type: github • Created: 2024-04-30 13:27:34 UTC • Stars: 3

Exploit CrushFTP CVE-2024-4040

Stuub/CVE-2024-4040-SSTI-LFI-PoC

Type: github • Created: 2024-04-25 19:51:38 UTC • Stars: 57

CVE-2024-4040 CrushFTP SSTI LFI & Auth Bypass | Full Server Takeover | Wordlist Support

rbih-boulanouar/CVE-2024-4040

Type: github • Created: 2024-04-25 04:45:38 UTC • Stars: 13

airbus-cert/CVE-2024-4040

Type: github • Created: 2024-04-23 09:31:29 UTC • Stars: 47

Scanner for CVE-2024-4040