| At line 1 changed 2 lines |
| __April 19th, 2024 - CVE-2024-4040\\ |
| CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0. Customers using a [DMZ] in front of their main CrushFTP instance are partially protected with its protocol translation system it utilizes. A DMZ however does not fully protect you and you must update immediately. (CREDIT:Simon Garrelou, of Airbus CERT)__\\ |
| !!!__CrushFTP 11.0.0 to 11.3.0 are vulnerable. Update to 11.3.1+ immediately.__ |
| !!!__CrushFTP 10.0.0 to 10.8.3 are vulnerable. Update to 10.8.4+ immediately.__ |
| !!![Some guidance on detection and what to do if compromised...|Compromise] |
| At line 5 added 26 lines |
|
| !!!__Automated Updating__ |
| Setting the flag "daily_check_and_auto_update_on_idle" to true in prefs.XML of CrushFTP v11.2.3_19+ will do automated daily checks and updates. |
|
| !!!__Update Bug on Windows__ |
| Some versions of CrushFTP had a problem applying an update automatically. They would fail to rename ".jar" files on Windows operating systems. They would instead leave behind ".jar_tmp" files needing the "_tmp" manually removed from them. This has been fixed for a while, but if you are still on one of these older builds, you will be affected the next time you attempt the update. So you need to fix the jar filenames one time manually. Example: CrushFTP.jar_tmp -> CrushFTP.jar. Same for all other jars in plugins, plugins/lib folder, and the WebInterface folder has CrushTunnel.jar. Do all 3 locations entirely. |
| \\ |
| \\ |
| !!Vulnerability Info |
| __March 21, 2025 - Unauthenticated HTTP(S) port access on CrushFTPv10/v11 (CVE: CVE-2025-31161)__\\ |
| This issue affects both CrushFTP v10 and v11. The exploit does not work if you have the [DMZ] proxy instance of CrushFTP in place. The vulnerability was respnsibly disclosed, it is not being used actively in the wild that we know of, no further details will be given at this time. (CVE-2025-0282 appears to be a copycat CVE issued automatically by an unaffiliated company.)\\ |
| 10.8.4 and 11.3.1 were published on 3/21/2025 and your CrushFTP instances would have notified you within a day of the new version if you are not blocking access to our update servers. Staying up to date is critical on an internet facing server. |
| ---- |
| November 11th, 2024 - (CVE-2024-53552 - CREDIT: Stratascale Cyber Research Unit)\\ |
| V10 versions below 10.8.3 and V11 versions below 11.2.3 are vulnerable to a password reset email exploit. If an end user clicks the link, their account is compromised.\\ |
| Once you update you must configure your allowed email reset URL domains.\\ |
| v10:Preferences, WebInterface, MiniURL: Set an allowed list of domains, comma separated.\\ |
| v11:Preferneces, WebInterface, Login Page: Set a domain pattern that is not just '*' as a '*' is no longer allowed.\\ |
| ---- |
| October 10, 2024 - (CVE-2024-11986 credit European Commission, Application Security Testing Services) \\ |
| XSS bug fixed in CrushFTP 10.8.2 and 11.2.1. |
| ---- |
| April 19th, 2024 - (CVE-2024-4040)\\ |
| CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0. Customers using a [DMZ] in front of their main CrushFTP instance are partially protected with its protocol translation system it utilizes. A DMZ however does not fully protect you and you must update immediately. (CREDIT:Simon Garrelou, of Airbus CERT)\\ |
| ---- |
| \\ |
| At line 5 changed 5 lines |
| •If I'm on v10.7.1...do I need to upgrade to v11? No, just update v10 to v10.7.1.\\ |
| •If I'm on v10.6.1, or v10.3, or v10.5.5, am I vulnerable? Yes! Update immediately to 10.7.1.\\ |
| •Can you tell me how I can check if I have been exploited? Not really..the nature of this was common words that could be in your log already. So there is no silver bullet search term to check for. Looking for "<INCLUDE" is an indicator.\\ |
| •If I have a DMZ am I safe? NO! As of April 22, we have changed our opinion on this. A DMZ does not fully protect you.\\ |
| •If I only have my SFTP port exposed to the internet but not any web ports...am I safe? Yes, this exploit specifically works with the WebInterface port.\\ |
| •If I'm on v10.8.4+...do I need to upgrade to v11? No, 10.8.4+ are safe.\\ |
| •If I'm on v10.6.1, or v10.3, or v10.5.5, am I vulnerable? Yes! Update immediately to 10.8.4+ or v11.3.1+.\\ |
| At line 35 added one line |
| ---- |
| At line 25 changed one line |
| 2.) Give it the specific name `CrushFTP10_new.zip` and place this in the CrushFTP main folder. (Same location where you have your prefs.XML file)\\ |
| 2.) Give it the specific name `CrushFTP11_new.zip` and place this in the CrushFTP main folder. (Same location where you have your CrushFTP.jar file)\\ |
| At line 27 changed 2 lines |
|
|
| \\ |
| \\ |
| !Fully manual offline update: |
| In some rare scenarios when neither of the above methods work, like file permissions prevent consuming the update file or overwriting the necessary components by the updater. In such case: |
| 1.) Download CrushFTP11.zip from our download page. ([https://www.crushftp.com/early11/CrushFTP11.zip|https://www.crushftp.com/early11/CrushFTP11.zip])\\ |
| 2.) Unzip it to a temporary directory\\ |
| 3.) Stop the CrushFTP service |
| 4.) Copy over the installation the full content or just the __CrushFTP.jar__ file and the __plugins and WebInterface__ subdirectories as these are. Overwrite all when prompted.\\ |
| 5.) Start the Crush service. Once back on line, clear the browser cache or check with an incognito/private browser session. \\ |
| \\ |
| ---- |
| \\ |
| At line 70 added one line |
| ---- |
| At line 72 added one line |
| ---- |
