CVE-2025-31161

What it actually does

CVE-2025-31161 is an unauthenticated authentication-bypass vulnerability in the CrushFTP HTTP/HTTPS component affecting CrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1 when directly exposed without a DMZ proxy instance. The flaw is in the AWS4-HMAC/S3-compatible authorization handling. By abusing the server’s user-existence check and malformed AWS4-HMAC authorization parsing, an attacker can cause CrushFTP to authenticate a session as a known or guessable user without knowing that user’s password. In practical exploitation, attackers target privileged accounts such as crushadmin, resulting in administrative takeover of the CrushFTP instance and potential access to files, credentials, configuration, and connected systems.

Why it matters to the business

A successful attack can give an external attacker administrative control of an internet-facing file-transfer server, allowing theft, deletion, or manipulation of sensitive files and configuration data. Because this vulnerability is listed in CISA KEV, has observed exploitation in the wild, is associated with ransomware activity, and has an extremely high EPSS likelihood, affected exposed systems should be treated as urgent incident-response candidates, not just routine patching tasks. Organizations using CrushFTP for business-critical file exchange may face data exposure, service disruption, regulatory reporting obligations, extortion risk, and compromise of partner or supply-chain workflows.

How an attack unfolds

An attacker first identifies a CrushFTP HTTP or HTTPS service exposed to the network. They then send crafted requests using the S3-compatible AWS4-HMAC authorization flow. The vulnerable server performs an early username lookup through its login handling without requiring the real password. By racing the authentication flow or, more reliably, by sending a malformed AWS4-HMAC header containing only a username followed by a slash and omitting expected signed-header data, the attacker causes the session to remain authenticated while cleanup logic is not reached. If the supplied username is valid, such as the commonly targeted crushadmin account, the attacker gains an authenticated session as that user. With administrative access, the attacker can review configuration, access stored files, create or modify users, change server settings, retrieve secrets, deploy persistence, stage data for exfiltration, or support ransomware operations.

How to fix it

Upgrade CrushFTP immediately to a fixed release: CrushFTP 10.8.4 or later for version 10, and CrushFTP 11.3.1 or later for version 11. If immediate upgrade is not possible, remove direct internet exposure to the CrushFTP HTTP/HTTPS service, restrict access with VPN or allowlisted administrative networks, and use a properly configured CrushFTP DMZ proxy instance as recommended by the vendor. Rotate passwords and API credentials for CrushFTP administrative and privileged accounts after patching, because credentials and sessions may have been exposed. Review all CrushFTP users, permissions, automation accounts, integrations, and recent configuration changes for unauthorized additions or modifications. Invalidate active sessions where supported and restart the service after upgrade. Because this vulnerability is exploited in the wild and associated with ransomware campaigns, exposed vulnerable systems should undergo compromise assessment even after patching.

How to confirm the fix worked

Confirm the running CrushFTP version is 10.8.4 or later for the 10.x branch, or 11.3.1 or later for the 11.x branch. Verify that the HTTP/HTTPS service is not directly reachable from untrusted networks unless protected by the recommended DMZ proxy or equivalent network controls. Review vendor release notes and application build information to ensure the patched binary is active, not merely downloaded. Test authentication flows to confirm that malformed AWS4-HMAC requests do not create authenticated sessions. Validate that administrative login history, user lists, permissions, and configuration match expected state. Run an external exposure scan to confirm no vulnerable CrushFTP instance remains reachable from the internet.

Typical attack path

1. Scan for internet-accessible CrushFTP HTTP/HTTPS services.
2. Fingerprint the service version or behavior to identify potentially vulnerable CrushFTP 10 or 11 deployments.
3. Guess or enumerate a valid username, commonly targeting administrative names such as crushadmin.
4. Send crafted AWS4-HMAC/S3-compatible Authorization headers to trigger authentication without a valid password.
5. Obtain an authenticated session as the targeted user.
6. Access the CrushFTP administrative interface or APIs using the hijacked session.
7. Create additional accounts, modify permissions, inspect configuration, and access stored or transferred files.
8. Exfiltrate data, deploy persistence, disrupt file-transfer operations, or use the server as a staging point for further intrusion or ransomware activity.

How to detect it

To determine whether exploitation already occurred, review CrushFTP application logs, HTTP/HTTPS access logs, reverse-proxy logs, WAF logs, operating-system logs, authentication records, and file-transfer audit logs from at least March 2025 onward, or longer where retention allows. Focus on requests to CrushFTP containing AWS4-HMAC or S3-compatible Authorization headers, especially malformed Credential values ending after a username and slash, missing SignedHeaders fields, parsing errors, or index-out-of-bounds exceptions around authentication. Investigate any successful login or session creation for crushadmin or other privileged users from unfamiliar IP addresses, unusual geographies, hosting providers, TOR/VPN infrastructure, or outside normal administrative windows. Review administrative events after suspicious logins, including new user creation, password changes, permission changes, changes to IP restrictions, modification of scheduled jobs, DMZ/proxy settings changes, and configuration exports. Examine file activity for bulk downloads, recursive directory access, archive creation, abnormal deletions, renamed files, ransom notes, or transfers to unfamiliar destinations. On the host, look for new scripts, web-accessible files, unexpected processes, persistence mechanisms, compressed archives, credential-dumping tools, and outbound network connections that do not align with normal file-transfer use. Because exploitation may not leave a clean password-failure trail, absence of failed logins does not rule out compromise; prioritize anomalous successful sessions and malformed AWS4-HMAC request artifacts.

• AWS4-HMAC-SHA256
• AWS4-HMAC
• Credential=crushadmin/
• Credential=admin/
• Credential=administrator/
• SignedHeaders
• Authorization: AWS4-HMAC-SHA256 Credential=
• java.lang.ArrayIndexOutOfBoundsException
• IndexOutOfBoundsException
• crushadmin
• login_user_pass
• anypass
• /WebInterface/
• /WebInterface/function/
• /WebInterface/function/?command=
• /api/
• /WebInterface/login.html
• CrushFTP.log
• CrushFTP10.log
• CrushFTP11.log
• users/MainUsers/
• sessions.obj
• prefs.XML

What your security team should do

• Treat any internet-exposed vulnerable CrushFTP instance as potentially compromised and begin incident-response triage before or immediately after patching.
• Upgrade to CrushFTP 10.8.4+ or 11.3.1+ as the highest-priority remediation action.
• Meet or exceed the CISA KEV remediation urgency; the listed KEV due date was 2025-04-28 and exploitation has been observed in the wild.
• Temporarily block or restrict external HTTP/HTTPS access to CrushFTP until patching and validation are complete.
• Search logs for AWS4-HMAC authorization anomalies, malformed Credential values, missing SignedHeaders values, unexpected crushadmin logins, and administrative changes from unfamiliar IP addresses.
• Rotate CrushFTP administrative passwords, automation credentials, API keys, and any secrets stored in or accessible from the server.
• Audit all CrushFTP users, groups, permissions, scheduled jobs, scripts, and configuration for unauthorized changes.
• Review transferred files and server storage for evidence of staging, compression, bulk download, deletion, or ransom-related activity.
• Preserve application logs, web access logs, system logs, and configuration snapshots before making major cleanup changes to support forensic analysis.
• Add monitoring rules for future AWS4-HMAC authentication anomalies and unexpected administrative-session creation.