CVE-2025-31161

{"id": "CVE-2025-31161", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-04-03T20:15:25.373", "references": [{"url": "https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://projectdiscovery.io/blog/crushftp-authentication-bypass", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation", "tags": ["Press/Media Coverage"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/", "tags": ["Press/Media Coverage"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-305"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka \"Unauthenticated HTTP(S) port access.\" A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account."}, {"lang": "es", "value": "CrushFTP 10 anterior a la 10.8.4 y 11 anterior a la 11.3.1 permite omitir la autenticaci\u00f3n y tomar el control de la cuenta crushadmin (a menos que se utilice una instancia de proxy DMZ), como se explot\u00f3 en marzo y abril de 2025, tambi\u00e9n conocido como \"Acceso al puerto HTTP(S) sin autenticar\". Existe una condici\u00f3n de ejecuci\u00f3n en el m\u00e9todo de autorizaci\u00f3n AWS4-HMAC (compatible con S3) del componente HTTP del servidor FTP. El servidor verifica primero la existencia del usuario mediante una llamada a login_user_pass() sin necesidad de contrase\u00f1a. Esto autenticar\u00e1 la sesi\u00f3n mediante el proceso de verificaci\u00f3n HMAC hasta que el servidor vuelva a verificar la verificaci\u00f3n del usuario. La vulnerabilidad se puede estabilizar a\u00fan m\u00e1s, eliminando la necesidad de activar una condici\u00f3n de ejecuci\u00f3n, mediante el env\u00edo de un encabezado AWS4-HMAC alterado. Al proporcionar \u00fanicamente el nombre de usuario y una barra diagonal (/), el servidor encontrar\u00e1 un nombre de usuario, lo que activar\u00e1 la autenticaci\u00f3n anypass. Sin embargo, no encontrar\u00e1 la entrada SignedHeaders esperada, lo que generar\u00e1 un error de indexaci\u00f3n fuera de los l\u00edmites que impedir\u00e1 que el c\u00f3digo complete la limpieza de la sesi\u00f3n. En conjunto, estos problemas dificultan la autenticaci\u00f3n con cualquier usuario conocido o indeterminado (p. ej., crushadmin) y pueden comprometer por completo el sistema al obtener una cuenta administrativa."}], "lastModified": "2025-04-21T21:03:07.753", "cisaActionDue": "2025-04-28", "cisaExploitAdd": "2025-04-07", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABD1B990-3D20-49A1-B62D-60BE724EE83F", "versionEndExcluding": "10.8.4", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "832C5DBF-FF1C-447E-812E-063CD844EE07", "versionEndExcluding": "11.3.1", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "CrushFTP Authentication Bypass Vulnerability"}