{"uuid": "c560b65b-0aa0-4126-99cd-96a7cdba372a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2825", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/crushftp_authbypass_cve_2025_2825.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Outpost24\", \"remmons-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module leverages an authentication bypass in CrushFTP 11 < 11.3.1 and 10 < 10.8.4. Attackers\\n          with knowledge of a valid username can provide a crafted S3 authentication header to the CrushFTP web API\\n          to authenticate as that user without valid credentials. When successfully executed, the exploit will\\n          output working session cookies for the target user account.\", \"disclosure_date\": null, \"fullname\": \"auxiliary/gather/crushftp_authbypass_cve_2025_2825\", \"is_install_path\": true, \"mod_time\": \"2025-04-03 10:24:46 +0000\", \"name\": \"CrushFTP AWS4-HMAC Authentication Bypass\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/crushftp_authbypass_cve_2025_2825.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/crushftp_authbypass_cve_2025_2825\", \"references\": [\"CVE-2025-2825\", \"URL-https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis\"], \"rport\": 8080, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:12.982697Z"}