CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
Em resumo
O CrushFTP possui uma falha crítica que permite que atacantes sem credenciais de login leiam arquivos do servidor, assumam acesso de administrador e executem código malicioso remotamente.
Detalhe técnico
Uma vulnerabilidade de injeção de template no lado do servidor no CrushFTP versões anteriores a 10.7.1 e 11.1.0 permite que atacantes remotos não autenticados executem código arbitrário e contornem mecanismos de autenticação. A falha possibilita acesso não autorizado ao sistema de arquivos fora da sandbox VFS e elevação de privilégios para administrador em todas as plataformas.
Resumo gerado e traduzido por IA a partir da descrição oficial.
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
CrushFTP · CrushFTPPoCs públicas encontradas — 19
githubgithub.com/Stuub/CVE-2024-4040-SSTI-LFI-PoC★ 63cve_referencegithub.com/airbus-cert/CVE-2024-4040★ 52githubgithub.com/rbih-boulanouar/CVE-2024-4040★ 14githubgithub.com/geniuszly/GenCrushSSTIExploit★ 8githubgithub.com/gotr00t0day/CVE-2024-4040★ 7githubgithub.com/dhammerg/CVE-2024-4040★ 5githubgithub.com/jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability★ 4githubgithub.com/entroychang/CVE-2024-4040★ 3githubgithub.com/rahisec/CVE-2024-4040★ 0githubgithub.com/ill-deed/CrushFTP-CVE-2024-4040-illdeed★ 0githubgithub.com/juanorts/CrushFTP10-Docker-CVE-2024-4040★ 0githubgithub.com/Sidjaz/CrushFTP-CVE-2024-4040-Proof-of-Concept★ 0githubgithub.com/cthhhhhh/CrushFTP-SSTI-LFI-Proof-of-Concept★ 0githubgithub.com/Mufti22/CVE-2024-4040★ 0githubgithub.com/0xN7y/CVE-2024-4040★ 0githubgithub.com/Praison001/CVE-2024-4040-CrushFTP-server★ 0githubgithub.com/1ncendium/CVE-2024-4040★ 0githubgithub.com/olebris/CVE-2024-4040★ 0githubgithub.com/safeer-accuknox/CrushFTP-cve-2024-4040-poc★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://github.com/airbus-cert/CVE-2024-4040https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Updatehttps://www.crushftp.com/crush11wiki/Wiki.jsp?page=Updatehttps://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/