View Attach (1) Info

Add new attachment

Only authorized users are allowed to upload new attachments.

List of attachments

Kind Attachment Name Size Version Date Modified Author Change note
jpg
 minor_update.jpg 356.6 kB 1 05-Dec-2023 05:32 Ada Csaba

This page (revision-36) was last changed on 03-Sep-2024 14:34 by Sandor

This page was created on 05-Dec-2023 05:32 by Ben Spink

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Difference between version and

At line 1 changed one line
CrushFTP v11 has no known vulnerabilities.\\
__April 19th, 2024 - CVE-2024-4040\\
CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0. Customers using a [DMZ] in front of their main CrushFTP instance are partially protected with its protocol translation system it utilizes. A DMZ however does not fully protect you and you must update immediately. (CREDIT:Simon Garrelou, of Airbus CERT)__\\
At line 3 changed one line
CrushFTP v10 info: [/early10/Wiki.jsp?page=Update]\\
!!FAQ:
•If I'm on v10.7.1...do I need to upgrade to v11? No, just update v10 to v10.7.1.\\
•If I'm on v10.6.1, or v10.3, or v10.5.5, am I vulnerable? Yes! Update immediately to 10.7.1.\\
•Can you tell me how I can check if I have been exploited? Not really..the nature of this was common words that could be in your log already. So there is no silver bullet search term to check for. Looking for "<INCLUDE" is an indicator.\\
•If I have a DMZ am I safe? NO! As of April 22, we have changed our opinion on this. A DMZ does not fully protect you.\\
•If I only have my SFTP port exposed to the internet but not any web ports...am I safe? Yes, this exploit specifically works with the WebInterface port.\\
\\
\\
!!Updating CrushFTP v11
!How to update CrushFTP within the same major version number:
1.) Login to the dashboard using your "crushadmin" equivalent user in the WebInterface.\\
2.) Click on the about tab.\\
3.) Click Update, Update Now.\\
4.) Wait roughly 5 minutes for the files to download, unzip, and be copied in place. CrushFTP will auto restart once done.\\
5.) Finished.\\
\\
[{Image src='minor_update.jpg' width='1080' height='..' align='left' style='..' class='..' }]\\
\\
!Installing an offline update when the server cannot reach our server over the internet directly:
1.) Download CrushFTP11.zip from our download page. ([https://www.crushftp.com/early11/CrushFTP11.zip|https://www.crushftp.com/early11/CrushFTP11.zip])\\
2.) Give it the specific name `CrushFTP11_new.zip` and place this in the CrushFTP main folder. (Same location where you have your CrushFTP.jar file)\\
3.) See above normal instructions as Crush will use your local offline zip file.\\
!How to restore a backup in the event of some issue or regression in functionality:
(CrushFTP automatically creates a backup of its core files in the CrushFTP folder, backup folder.)\\
1.) Restore the CrushFTP.jar file.\\
2.) Restore the plugins folder.\\
3.) Restore the WebInterface folder...mainly the CrushTunnel.jar file from inside it.\\
\\
!Changelog: [https://www.crushftp.com/version11_build.html]\\
\\
!!Updating an old CrushFTP v10,v9 and prior
You must upgrade: [CrushFTPUpgrade]\\
You need a v11 license code first! If you are an enterprise customer, contact us for your code. Its free if your maintenance is current.
\\
All prior versions of CrushFTP were also affected by this most recent vulnerability.\\
CrushFTP v10 info: [https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update]\\
Version Date Modified Size Author Changes ... Change note
36 03-Sep-2024 14:34 2.985 kB Sandor to previous
35 01-Aug-2024 11:05 2.982 kB Sandor to previous | to last
34 22-Apr-2024 15:52 2.982 kB Ben Spink to previous | to last
33 22-Apr-2024 15:51 3.006 kB Ben Spink to previous | to last
32 22-Apr-2024 12:39 2.99 kB Ben Spink to previous | to last
31 22-Apr-2024 12:25 3.028 kB Ben Spink to previous | to last
30 22-Apr-2024 12:23 2.964 kB Ben Spink to previous | to last
29 19-Apr-2024 12:37 2.16 kB Ada Csaba to previous | to last
28 19-Apr-2024 12:36 2.157 kB Ada Csaba to previous | to last
27 19-Apr-2024 12:36 2.153 kB Ada Csaba to previous | to last
26 19-Apr-2024 12:34 2.604 kB Ada Csaba to previous | to last
25 19-Apr-2024 05:27 0.521 kB Ben Spink to previous | to last
24 19-Apr-2024 04:58 0.48 kB Ben Spink to previous | to last
23 28-Feb-2024 03:11 0.132 kB Ben Spink to previous | to last
22 28-Feb-2024 03:10 0.104 kB Ben Spink to previous | to last
21 27-Feb-2024 03:43 4.237 kB Ben Spink to previous | to last
« This page (revision-36) was last changed on 03-Sep-2024 14:34 by Sandor
G’day (anonymous guest)
CrushFTP11 | What's New

Referenced by
LeftMenu

JSPWiki