CVE-2024-4040

What it actually does

CVE-2024-4040 is an unauthenticated server-side template injection vulnerability in CrushFTP that affects versions before 10.7.1 in the 10.x branch and before 11.1.0 in the 11.x branch. By abusing template-processing behavior, a remote attacker can escape the CrushFTP VFS sandbox, read arbitrary files from the underlying server filesystem, bypass authentication to obtain administrative access, and ultimately execute code on the server. The flaw is network-exploitable, requires no credentials or user interaction, and can result in full confidentiality, integrity, and availability compromise of the CrushFTP host.

Why it matters to the business

A successful compromise can expose transferred files, credentials, configuration secrets, and customer or partner data handled by the file-transfer service. Because the vulnerability can lead to administrative takeover and remote code execution, attackers may use the server as an entry point for broader intrusion, data theft, persistence, or service disruption. This issue is listed in CISA KEV with a required remediation date of 2024-05-01, has very high EPSS likelihood, and is reported as actively exploited in the wild, so any internet-facing CrushFTP deployment running an affected version should be treated as high urgency.

How an attack unfolds

An attacker first identifies an exposed CrushFTP service and determines whether it is running an affected pre-10.7.1 or pre-11.1.0 version. The attacker then sends crafted unauthenticated HTTP requests that trigger server-side template evaluation in vulnerable CrushFTP functionality. If successful, the template injection allows access outside the intended VFS sandbox, enabling the attacker to read local files such as configuration files, user data, keys, or operating system files. The attacker can use information recovered from the filesystem to bypass authentication or obtain administrative access to the CrushFTP application. With administrative control, the attacker can modify configuration, create accounts, access files, upload malicious content, or execute commands on the underlying server, resulting in full system compromise. Public exploitation activity is associated with the CrushFTP VFS sandbox escape issue, although no specific named intrusion group is provided in the input.

How to fix it

Upgrade immediately. CrushFTP 10.x deployments should be upgraded to version 10.7.1 or later, and CrushFTP 11.x deployments should be upgraded to version 11.1.0 or later. If immediate patching is not possible, remove CrushFTP from direct internet exposure, restrict access to trusted IP ranges or VPNs, enforce WAF/reverse-proxy controls where available, and disable unnecessary external interfaces until the upgrade is complete. After patching, rotate CrushFTP administrator credentials, review and rotate any credentials or keys stored on the server, audit user accounts and permissions, review VFS mappings, and remove unknown accounts, jobs, plugins, or configuration changes. Because exploitation can lead to host-level compromise, organizations should also assess whether the server requires forensic preservation, rebuild, or restoration from known-good media if suspicious activity is found.

How to confirm the fix worked

Confirm the installed CrushFTP version is 10.7.1 or later for the 10.x branch, or 11.1.0 or later for the 11.x branch. Verify the patched version through the product administration interface, service startup logs, package inventory, and any external vulnerability scanner results. Confirm the service is not unnecessarily exposed to the internet and that access controls are enforced at the network edge. Review HTTP access logs to ensure unauthenticated requests cannot access privileged functions or files outside configured VFS paths. Perform a non-destructive validation using an approved scanner or vendor-supported check rather than live exploit payloads. Validate that no unexpected administrator accounts, scheduled tasks, user mappings, VFS paths, SSH keys, API keys, or startup scripts were added before or during the remediation window.

Typical attack path

1. Scan the internet or target network for exposed CrushFTP HTTP/HTTPS services.
2. Fingerprint the service version or infer vulnerability from behavior.
3. Send crafted unauthenticated requests that abuse server-side template injection.
4. Use the flaw to escape the VFS sandbox and read files from the host filesystem.
5. Extract sensitive configuration, credential, session, or user data from local files.
6. Bypass authentication or gain administrative access to the CrushFTP application.
7. Use administrative access to access transferred files, create persistence, alter settings, or execute code on the server.
8. Expand access to the underlying host or adjacent systems if credentials or trust relationships are exposed.

How to detect it

Investigate CrushFTP application logs, HTTP/S reverse-proxy logs, WAF logs, load balancer logs, authentication logs, administrator audit logs, and host endpoint telemetry for activity before and after patching. Focus on unauthenticated or unusual requests to CrushFTP web interfaces, especially requests containing template-like syntax, encoded traversal, references to sensitive operating system files, or attempts to access functionality before login. Correlate suspicious web requests with successful administrator logins, password changes, new user creation, modified VFS mappings, new scheduled jobs, unexpected uploads, configuration exports, or service restarts. On the host, review process creation events for unexpected child processes spawned by the CrushFTP service, outbound network connections from the CrushFTP process, newly written web-accessible files, modified startup scripts, and access to sensitive files such as system password files, SSH keys, or CrushFTP configuration files. Because this vulnerability can expose credentials and enable administrative takeover, absence of a single IOC is not sufficient; use behavioral correlation across web logs, product audit logs, and endpoint telemetry.

• /WebInterface/
• /WebInterface/function/
• /WebInterface/login.html
• /WebInterface/admin/
• %2e%2e
• ../
• /etc/passwd
• /etc/shadow
• C:\Windows\win.ini
• C:\Windows\System32\config\SAM
• CrushFTP.log
• session_HTTP.log
• CrushFTP/users/
• CrushFTP/users/MainUsers/
• crushftp.jar
• crushftp_init.sh
• CrushFTP.exe

What your security team should do

• Treat all internet-facing affected CrushFTP instances as potentially compromised until log review and host checks are complete.
• Patch immediately to CrushFTP 10.7.1+ or 11.1.0+; this is a CISA KEV vulnerability with a 2024-05-01 remediation deadline and active exploitation in the wild.
• Temporarily restrict access to CrushFTP from trusted networks only if patching cannot be completed immediately.
• Collect and preserve CrushFTP application logs, HTTP access logs, authentication logs, administrative audit logs, and host telemetry before restarting or rebuilding systems.
• Hunt for unauthenticated requests to CrushFTP endpoints followed by file reads, administrator logins, new user creation, configuration changes, uploads, or process execution.
• Rotate CrushFTP administrator passwords, service credentials, stored partner credentials, SSH keys, API keys, and any secrets accessible from the CrushFTP host.
• Review all CrushFTP users, groups, VFS mappings, scheduled jobs, plugins, scripts, and automation for unauthorized changes.
• If suspicious activity is confirmed, isolate the host, perform forensic analysis, and consider rebuilding the server from known-good media.