At line 1 changed 4 lines |
!!!Minimum safe CrushFTP version is 10.5.5. |
---- |
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT NOVEMBER 16, 2023! |
If your CrushFTP is lower than 10.5.5, you are vulnerable to an exploit that was responsibly disclosed. It is not known to be in he wild, but its severe and everyone must update immediately. All versions of CrushFTP...v4/v5/v6/v7/v8/v9/v10 were affected by this. CrushFTP v11 is not affected by this as it has been patched before its first public release. One part of the vulnerability allows an attacker to gain access simply by knowing the admin username, and the other parts when used together allows an attacker who has a non privileged account to gain access to files outside their VFS which can then be in turn used to login as a more privileged user. CVE release is pending. Credit goes to the UK NCSC.\\ |
__April 19th, 2024 - CVE-2024-4040\\ |
CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0. Customers using a [DMZ] in front of their main CrushFTP instance are partially protected with its protocol translation system it utilizes. A DMZ however does not fully protect you and you must update immediately. (CREDIT:Simon Garrelou, of Airbus CERT)__\\ |
At line 6 changed one line |
!!REGARDING THE RECENT VULNERABILITY ANNOUNCEMENT AUGUST 10, 2023! (CVE-2023-43177) |
!!FAQ: |
•If I'm on v10.7.1...do I need to upgrade to v11? No, just update v10 to v10.7.1.\\ |
•If I'm on v10.6.1, or v10.3, or v10.5.5, am I vulnerable? Yes! Update immediately to 10.7.1.\\ |
•Can you tell me how I can check if I have been exploited? Not really..the nature of this was common words that could be in your log already. So there is no silver bullet search term to check for. Looking for "<INCLUDE" is an indicator.\\ |
•If I have a DMZ am I safe? NO! As of April 22, we have changed our opinion on this. A DMZ does not fully protect you.\\ |
•If I only have my SFTP port exposed to the internet but not any web ports...am I safe? Yes, this exploit specifically works with the WebInterface port.\\ |
At line 8 removed 2 lines |
If your CrushFTP version is less then 10.5.1, you are vulnerable. No exception. Look at your version number on the dashboard, and it must be 10.5.1 or higher to be safe. For reference, v6, v7, v8,v9...those numbers are less than v10.5.1. Yes, they are vulnerable! Anything below 10.5.1 is vulnerable.\\ |
This vulnerability is critical because it does NOT require any authentication. It can be done anonymously and steal the session of other users and escalate to an administrator user. Its critical everyone updates ASAP! 10.5.2 changes other defaults related to loading DB drivers that are not in your classpath has also changed. This means if your DB drivers are not part of your plugins/lib folder, they will not be loaded by CrushFTP. (Statistics DB if you changed it, SQL Users if you are using that, etc.)\\ |
At line 11 changed one line |
!!Updating CrushFTP v10 |
!!Updating CrushFTP v11 |
At line 23 changed 2 lines |
1.) Download CrushFTP10.zip from our download page. ([https://www.crushftp.com/early10/CrushFTP10.zip|https://www.crushftp.com/early10/CrushFTP10.zip])\\ |
2.) Give it the specific name `CrushFTP10_new.zip` and place this in the CrushFTP main folder. (Same location where you have your prefs.XML file)\\ |
1.) Download CrushFTP11.zip from our download page. ([https://www.crushftp.com/early11/CrushFTP11.zip|https://www.crushftp.com/early11/CrushFTP11.zip])\\ |
2.) Give it the specific name `CrushFTP11_new.zip` and place this in the CrushFTP main folder. (Same location where you have your prefs.XML file)\\ |
At line 34 changed one line |
!Changelog: [https://www.crushftp.com/version10_build.html]\\ |
!Changelog: [https://www.crushftp.com/version11_build.html]\\ |
At line 36 changed one line |
!!Updating an old CrushFTP v9 |
!!Updating an old CrushFTP v10,v9 and prior |
At line 38 changed one line |
You need a v10+ license code first! If you are an enterprise customer, contact us for your code. Its free if your maintenance is current. |
You need a v11 license code first! If you are an enterprise customer, contact us for your code. Its free if your maintenance is current. |
|
\\ |
All prior versions of CrushFTP were also affected by this most recent vulnerability.\\ |
CrushFTP v10 info: [https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update]\\ |