CVE-2023-43177

What it actually does

CVE-2023-43177 is a critical remotely exploitable flaw in CrushFTP versions prior to 10.5.1 caused by unsafe modification of dynamically determined object attributes. In practical terms, the application accepts attacker-controlled input that can alter internal object properties that should not be user-controlled. Because the flaw is reachable over the network without authentication or user interaction, an attacker may be able to manipulate server-side state, bypass intended authorization boundaries, access or modify managed file-transfer data, and potentially achieve broader compromise of the CrushFTP application depending on exposed configuration and privileges.

Why it matters to the business

A vulnerable internet-facing CrushFTP server can be compromised without valid credentials, putting sensitive file-transfer data, partner/customer documents, credentials, and business workflows at risk. The CVSS score is critical, EPSS is very high at approximately 81.8%, and exploit maturity is listed as weaponized, so organizations should treat exposed instances as high-priority even though the issue is not currently listed in CISA KEV. Successful exploitation can result in data theft, unauthorized file changes, service disruption, and loss of trust in managed file-transfer operations.

How an attack unfolds

An attacker first identifies a CrushFTP web interface exposed to the internet and determines whether it is running a version prior to 10.5.1. The attacker then sends crafted unauthenticated HTTP requests containing parameters designed to modify server-side object attributes that the application dynamically maps from user input. If accepted, those modified attributes can alter application behavior, session or user-related state, access controls, or file-transfer operations. From there, the attacker may enumerate accessible resources, read or alter files managed by the server, attempt privilege escalation within the application, harvest credentials or configuration material, and use the compromised file-transfer server as a staging point for further intrusion.

How to fix it

Upgrade CrushFTP to version 10.5.1 or later. If immediate upgrade is not possible, restrict access to the CrushFTP web interface to trusted networks or VPNs, disable unnecessary public exposure, enforce reverse-proxy access controls, and monitor for unauthenticated requests to sensitive CrushFTP endpoints. Review CrushFTP users, groups, virtual file-system mappings, automation jobs, shared links, and administrative settings for unauthorized changes after patching. Rotate credentials, API keys, and secrets that may have been accessible through the server, especially if the instance was internet-facing before remediation.

How to confirm the fix worked

Confirm the running CrushFTP version is 10.5.1 or later using the administrative interface, vendor-supported version check, package metadata, or server startup logs. Verify that no vulnerable CrushFTP instance remains reachable from the internet or untrusted networks. Re-test externally exposed services to ensure only intended ports and paths are accessible. After upgrading, review recent configuration changes, user additions, permission changes, uploaded files, shared links, and administrative events to confirm there are no signs of prior compromise.

Typical attack path

1. Scan for exposed CrushFTP web interfaces over HTTP or HTTPS.
2. Fingerprint the CrushFTP version or infer vulnerable behavior from responses.
3. Send crafted unauthenticated requests that attempt to modify dynamically mapped server-side object attributes.
4. Use the altered application state to bypass intended restrictions or gain unauthorized access to file-transfer functionality.
5. Enumerate users, virtual file systems, shared directories, logs, and configuration data reachable through the compromised application context.
6. Download sensitive files, upload malicious files, alter existing files, or abuse the server as a persistence or staging point.
7. Cover tracks by deleting uploaded files, modifying timestamps where possible, or blending activity into normal file-transfer traffic.

How to detect it

Investigate whether exploitation already occurred by reviewing CrushFTP application logs, web server or reverse-proxy access logs, operating-system logs, endpoint telemetry, and network egress records around the exposure window. Look for unauthenticated requests to CrushFTP web/API paths followed by unusual authentication events, new users, permission changes, unexpected file downloads, unusual uploads, creation of shared links, configuration changes, or administrative actions from unfamiliar IP addresses. Pay close attention to activity from scanners or hosting providers, requests with unusually large or complex query strings or form bodies, repeated probing of WebInterface endpoints, and requests that precede successful access without a normal login sequence. On the host, inspect CrushFTP installation directories, logs, plugin directories, temporary directories, and upload locations for newly created scripts, archives, binaries, or files with timestamps matching suspicious web requests. Correlate file-transfer events with outbound network connections to identify possible exfiltration or staging activity.

• /WebInterface/
• /WebInterface/function/
• /WebInterface/login.html
• command=
• CrushFTP.log
• logs/CrushFTP.log
• logs/session_logs/
• CrushFTP10/logs/
• CrushFTP11/logs/
• crushftp.jar
• plugins/lib/
• users/MainUsers/
• prefs.XML
• session_logs

What your security team should do

• Immediately inventory all CrushFTP deployments, prioritizing internet-facing systems.
• Upgrade all affected CrushFTP instances to 10.5.1 or later.
• If patching is delayed, place CrushFTP behind VPN, allowlist trusted source IPs, or block public access to the web interface.
• Review logs for unauthenticated or unusual requests to CrushFTP web/API endpoints before and after the patch date.
• Audit CrushFTP users, administrator accounts, virtual file-system permissions, shared links, scheduled jobs, and recent file activity for unauthorized changes.
• Rotate credentials and secrets that may have been stored in or transferred through affected CrushFTP servers.
• Hunt for suspicious uploads, web-accessible scripts, unexpected archives, and abnormal outbound connections from the CrushFTP host.
• Enable centralized logging for CrushFTP application logs, web/proxy logs, operating-system process events, and network egress telemetry.
• Treat vulnerable, internet-facing instances as potentially compromised due to high EPSS and weaponized exploit availability.