CVE-2025-54309

What it actually does

CVE-2025-54309 is an authentication bypass in CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23. When the DMZ proxy feature is not in use, CrushFTP mishandles AS2 validation over HTTPS, allowing a remote unauthenticated attacker to obtain administrative access. Successful exploitation can give the attacker full control of the CrushFTP application, including user management, file access, configuration changes, and potentially execution of application-level actions available to administrators.

Why it matters to the business

An exposed vulnerable CrushFTP server can be taken over remotely, putting sensitive file-transfer data, partner integrations, credentials, and business workflows at risk. Because this vulnerability is in CISA KEV, has been exploited in the wild since July 2025, has very high exploit likelihood, and the CISA remediation deadline of 2025-08-12 has passed, any remaining exposure should be treated as an urgent incident-level risk even though it is not currently flagged as ransomware-associated in KEV.

How an attack unfolds

An attacker scans the internet or a target network for CrushFTP HTTPS services running affected 10.x or 11.x versions without the DMZ proxy feature. The attacker sends crafted HTTPS traffic that abuses the flawed AS2 validation path, causing the server to trust the request improperly and grant administrative access without valid credentials. Once administrative access is obtained, the attacker can inspect files, download or stage data, create or modify users, change server configuration, establish persistence through new accounts or scheduled jobs, and use the file-transfer platform as a foothold for further internal access. Public reporting identifies active exploitation activity tracked as CrushFTP zero-day exploitation and an unprotected alternate channel issue, so defenders should assume that internet-facing vulnerable instances were attractive targets soon after disclosure.

How to fix it

Upgrade immediately to a fixed CrushFTP release: version 10.8.5 or later for CrushFTP 10.x, and version 11.3.4_23 or later for CrushFTP 11.x. If immediate upgrade is not possible, remove public exposure, restrict HTTPS access to trusted IP ranges or VPN, place the service behind the CrushFTP DMZ proxy where applicable, and block untrusted access at a reverse proxy, WAF, or firewall. Because this vulnerability grants administrative access, treat vulnerable exposed systems as potentially compromised: rotate CrushFTP administrator passwords, rotate integration credentials and keys handled by the platform, audit and remove unauthorized users, review jobs and automation, preserve logs, and consider rebuilding from a known-good state if exploitation cannot be ruled out.

How to confirm the fix worked

Confirm the installed CrushFTP version is 10.8.5 or later for the 10.x branch or 11.3.4_23 or later for the 11.x branch. Verify that any internet-facing deployment is either patched or protected by the DMZ proxy feature and additional network access controls. Review administrative account lists, recent configuration changes, scheduled jobs, user permissions, and file-transfer activity for unexpected changes. From outside the trusted network, verify that unauthenticated users cannot reach administrative functions or AS2-related paths in a way that results in privileged access. Confirm security monitoring covers CrushFTP application logs, web/reverse-proxy logs, authentication logs, and operating-system process/file activity around the application directory.

Typical attack path

1. Identify internet-facing CrushFTP HTTPS services.
2. Fingerprint the service version or behavior to determine whether it may be CrushFTP 10 before 10.8.5 or 11 before 11.3.4_23.
3. Confirm the DMZ proxy feature is not protecting the exposed service path.
4. Send crafted HTTPS requests that abuse the AS2 validation weakness.
5. Obtain an administrative session or equivalent administrative access without valid credentials.
6. Use the administrative interface or APIs to enumerate users, files, shares, jobs, and configuration.
7. Create or modify accounts, access sensitive transferred files, change configuration, or stage additional tooling.
8. Cover tracks by deleting or altering logs, removing temporary accounts, or blending activity into legitimate file-transfer operations.

How to detect it

Look for signs that HTTPS requests involving AS2 handling were followed by administrative actions without a normal authentication sequence. Primary log sources include CrushFTP application logs, session logs, administrative audit logs, reverse-proxy or load-balancer access logs, WAF logs, identity-provider logs if SSO is used, endpoint process telemetry, and file integrity monitoring for the CrushFTP installation and user configuration directories. Hunt for new or modified administrator accounts, unexpected password resets, changes to user permissions, new scheduled jobs, unexplained configuration edits, unusual downloads or archive creation, and log deletion or truncation after suspicious access. Correlate external source IPs making AS2-related requests with subsequent admin UI/API activity, especially where no valid login event, MFA event, or SSO assertion exists. Because exploitation was active in the wild, extend the lookback to at least July 2025 for systems that were internet-facing and vulnerable during that period.

• AS2
• /AS2
• admin access
• new admin
• user.XML
• prefs.XML
• CrushFTP.log
• session_logs
• jobs/
• MainUsers
• WebInterface
• CrushTask
• crushftp_init.sh
• CrushFTP.exe

What your security team should do

• Treat any exposed unpatched CrushFTP instance as a priority incident because the vulnerability is KEV-listed, actively exploited, and past the CISA remediation due date.
• Upgrade all affected CrushFTP 10.x and 11.x systems to fixed versions or later before relying on other mitigations.
• Temporarily remove internet exposure or restrict access to trusted networks until patching and validation are complete.
• Hunt for evidence of administrator access without a corresponding legitimate login, especially AS2-related HTTPS activity followed by admin actions.
• Audit all CrushFTP administrator and service accounts; remove unknown accounts and rotate credentials, API keys, SSH keys, and partner integration secrets.
• Review recent file downloads, uploads, share changes, automation jobs, and configuration edits for unauthorized activity.
• Preserve logs and forensic artifacts before rebuilding or cleaning systems if exploitation is suspected.
• Add detections for unexpected AS2 requests, new admin creation, privilege changes, suspicious CrushFTP child processes, and large or unusual outbound file transfers.