cvelistv5 - cve-2024-4040

CVE-2024-4040 (GCVE-0-2024-4040)

Vulnerability from cvelistv5 – Published: 2024-04-22 19:21 – Updated: 2025-10-21 23:05

CISA

Summary

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

directcyber

References

URL

	Vendor	Product	Version
	CrushFTP	CrushFTP	Affected: 10.0 , < 10.7.1 (semver) Affected: 11.0 , < 11.1.0 (semver)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2024-04-24

Due date: 2024-05-01

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Used in ransomware: Unknown

Notes: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update&version=34; https://nvd.nist.gov/vuln/detail/CVE-2024-4040

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:crushftp:crushftp:10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "crushftp",
            "vendor": "crushftp",
            "versions": [
              {
                "lessThan": "10.7.1",
                "status": "affected",
                "version": "10.0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:crushftp:crushftp:11.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "crushftp",
            "vendor": "crushftp",
            "versions": [
              {
                "lessThan": "11.1.0",
                "status": "affected",
                "version": "11.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4040",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T16:21:32.066730Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-04-24",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:20.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2024-04-24T00:00:00+00:00",
            "value": "CVE-2024-4040 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:26:57.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
          },
          {
            "tags": [
              "media-coverage",
              "x_transferred"
            ],
            "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/airbus-cert/CVE-2024-4040"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.crushftp.com/download.html",
          "defaultStatus": "affected",
          "product": "CrushFTP",
          "vendor": "CrushFTP",
          "versions": [
            {
              "lessThan": "10.7.1",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.1.0",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Simon Garrelou, of Airbus CERT"
        }
      ],
      "datePublic": "2024-04-18T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\u003cbr\u003e"
            }
          ],
          "value": "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\n"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Arbitrary File Read"
            }
          ]
        },
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        },
        {
          "capecId": "CAPEC-253",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-253 Remote Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-23T22:25:06.873Z",
        "orgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
        "shortName": "directcyber"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
        },
        {
          "tags": [
            "media-coverage"
          ],
          "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/airbus-cert/CVE-2024-4040"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated arbitrary file read and remote code execution in CrushFTP",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
    "assignerShortName": "directcyber",
    "cveId": "CVE-2024-4040",
    "datePublished": "2024-04-22T19:21:46.408Z",
    "dateReserved": "2024-04-22T19:08:08.183Z",
    "dateUpdated": "2025-10-21T23:05:20.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-4040",
      "cwes": "[\"CWE-1336\"]",
      "dateAdded": "2024-04-24",
      "dueDate": "2024-05-01",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\u0026version=34; https://nvd.nist.gov/vuln/detail/CVE-2024-4040",
      "product": "CrushFTP",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).",
      "vendorProject": "CrushFTP",
      "vulnerabilityName": "CrushFTP VFS Sandbox Escape Vulnerability"
    },
    "fkie_nvd": {
      "cisaActionDue": "2024-05-01",
      "cisaExploitAdd": "2024-04-24",
      "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "cisaVulnerabilityName": "CrushFTP VFS Sandbox Escape Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"10.0.0\", \"versionEndExcluding\": \"10.7.1\", \"matchCriteriaId\": \"1922C854-D367-44B7-AEFB-4AEB07679E16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"11.0.0\", \"versionEndExcluding\": \"11.1.0\", \"matchCriteriaId\": \"4EF482D8-4F40-454D-9A92-9D6924C582E2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\\n\"}, {\"lang\": \"es\", \"value\": \"VFS Sandbox Escape en CrushFTP en todas las versiones anteriores a 10.7.1 y 11.1.0 en todas las plataformas permite a atacantes remotos con privilegios bajos leer archivos del sistema de archivos fuera de VFS Sandbox.\"}]",
      "id": "CVE-2024-4040",
      "lastModified": "2024-11-21T09:42:05.023",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}]}",
      "published": "2024-04-22T20:15:07.803",
      "references": "[{\"url\": \"https://github.com/airbus-cert/CVE-2024-4040\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Press/Media Coverage\", \"Third Party Advisory\"]}, {\"url\": \"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Press/Media Coverage\", \"Third Party Advisory\"]}, {\"url\": \"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\", \"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"tags\": [\"Patch\", \"Press/Media Coverage\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/airbus-cert/CVE-2024-4040\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Press/Media Coverage\", \"Third Party Advisory\"]}, {\"url\": \"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Press/Media Coverage\", \"Third Party Advisory\"]}, {\"url\": \"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Press/Media Coverage\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "vulnStatus": "Undergoing Analysis",
      "weaknesses": "[{\"source\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1336\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-4040\",\"sourceIdentifier\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"published\":\"2024-04-22T20:15:07.803\",\"lastModified\":\"2025-11-04T14:36:21.647\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\\n\"},{\"lang\":\"es\",\"value\":\"VFS Sandbox Escape en CrushFTP en todas las versiones anteriores a 10.7.1 y 11.1.0 en todas las plataformas permite a atacantes remotos con privilegios bajos leer archivos del sistema de archivos fuera de VFS Sandbox.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"cisaExploitAdd\":\"2024-04-24\",\"cisaActionDue\":\"2024-05-01\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"CrushFTP VFS Sandbox Escape Vulnerability\",\"weaknesses\":[{\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1336\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.7.1\",\"matchCriteriaId\":\"1922C854-D367-44B7-AEFB-4AEB07679E16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.1.0\",\"matchCriteriaId\":\"4EF482D8-4F40-454D-9A92-9D6924C582E2\"}]}]}],\"references\":[{\"url\":\"https://github.com/airbus-cert/CVE-2024-4040\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Press/Media Coverage\",\"Third Party Advisory\"]},{\"url\":\"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Exploit\",\"Issue Tracking\"]},{\"url\":\"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\",\"source\":\"430a6cef-dc26-47e3-9fa8-52fb7f19644e\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/airbus-cert/CVE-2024-4040\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Press/Media Coverage\",\"Third Party Advisory\"]},{\"url\":\"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\"]},{\"url\":\"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"collectionURL\": \"https://www.crushftp.com/download.html\", \"defaultStatus\": \"affected\", \"product\": \"CrushFTP\", \"vendor\": \"CrushFTP\", \"versions\": [{\"lessThan\": \"10.7.1\", \"status\": \"affected\", \"version\": \"10.0\", \"versionType\": \"semver\"}, {\"lessThan\": \"11.1.0\", \"status\": \"affected\", \"version\": \"11.0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Simon Garrelou, of Airbus CERT\"}], \"datePublic\": \"2024-04-18T14:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\u003cbr\u003e\"}], \"value\": \"A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\\n\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Arbitrary File Read\"}]}, {\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}, {\"capecId\": \"CAPEC-253\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-253 Remote Code Inclusion\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-1336\", \"description\": \"CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"shortName\": \"directcyber\", \"dateUpdated\": \"2024-04-23T22:25:06.873Z\"}, \"references\": [{\"tags\": [\"vendor-advisory\"], \"url\": \"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\"}, {\"tags\": [\"vendor-advisory\"], \"url\": \"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\"}, {\"tags\": [\"related\"], \"url\": \"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\"}, {\"tags\": [\"media-coverage\"], \"url\": \"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\"}, {\"tags\": [\"exploit\"], \"url\": \"https://github.com/airbus-cert/CVE-2024-4040\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Unauthenticated arbitrary file read and remote code execution in CrushFTP\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T20:26:57.283Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\"}, {\"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update\"}, {\"tags\": [\"related\", \"x_transferred\"], \"url\": \"https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/\"}, {\"tags\": [\"media-coverage\", \"x_transferred\"], \"url\": \"https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/\"}, {\"tags\": [\"third-party-advisory\", \"x_transferred\"], \"url\": \"https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/\"}, {\"tags\": [\"third-party-advisory\", \"x_transferred\"], \"url\": \"https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/\"}, {\"tags\": [\"exploit\", \"x_transferred\"], \"url\": \"https://github.com/airbus-cert/CVE-2024-4040\"}]}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-4040\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-04T16:21:32.066730Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2024-04-24\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:crushftp:crushftp:10.0:*:*:*:*:*:*:*\"], \"vendor\": \"crushftp\", \"product\": \"crushftp\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0\", \"lessThan\": \"10.7.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:crushftp:crushftp:11.0:*:*:*:*:*:*:*\"], \"vendor\": \"crushftp\", \"product\": \"crushftp\", \"versions\": [{\"status\": \"affected\", \"version\": \"11.0\", \"lessThan\": \"11.1.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-22T20:24:36.682Z\"}, \"timeline\": [{\"time\": \"2024-04-24T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2024-4040 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-4040\", \"assignerOrgId\": \"430a6cef-dc26-47e3-9fa8-52fb7f19644e\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"directcyber\", \"dateReserved\": \"2024-04-22T19:08:08.183Z\", \"datePublished\": \"2024-04-22T19:21:46.408Z\", \"dateUpdated\": \"2025-07-28T19:43:21.512Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2024-4040

Vulnerability from gsd - Updated: 2024-04-23 05:02

Details

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

Aliases

CVE-2024-4040

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-4040"
      ],
      "details": "VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.\n",
      "id": "GSD-2024-4040",
      "modified": "2024-04-23T05:02:11.165045Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "report@directcyber.com.au",
        "ID": "CVE-2024-4040",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "CrushFTP",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "10.7.1",
                                "status": "affected",
                                "version": "10.0",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "11.1.0",
                                "status": "affected",
                                "version": "11.0",
                                "versionType": "semver"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "CrushFTP"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Simon Garrelou, of Airbus CERT"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-1336",
                "lang": "eng",
                "value": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update",
            "refsource": "MISC",
            "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
          },
          {
            "name": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update",
            "refsource": "MISC",
            "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
          },
          {
            "name": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/",
            "refsource": "MISC",
            "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
          },
          {
            "name": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/",
            "refsource": "MISC",
            "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
          },
          {
            "name": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/",
            "refsource": "MISC",
            "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
          },
          {
            "name": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/",
            "refsource": "MISC",
            "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
          },
          {
            "name": "https://github.com/airbus-cert/CVE-2024-4040",
            "refsource": "MISC",
            "url": "https://github.com/airbus-cert/CVE-2024-4040"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "cisaActionDue": "2024-05-01",
        "cisaExploitAdd": "2024-04-24",
        "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "CrushFTP VFS Sandbox Escape Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1922C854-D367-44B7-AEFB-4AEB07679E16",
                    "versionEndExcluding": "10.7.1",
                    "versionStartIncluding": "10.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4EF482D8-4F40-454D-9A92-9D6924C582E2",
                    "versionEndExcluding": "11.1.0",
                    "versionStartIncluding": "11.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\n"
          },
          {
            "lang": "es",
            "value": "VFS Sandbox Escape en CrushFTP en todas las versiones anteriores a 10.7.1 y 11.1.0 en todas las plataformas permite a atacantes remotos con privilegios bajos leer archivos del sistema de archivos fuera de VFS Sandbox."
          }
        ],
        "id": "CVE-2024-4040",
        "lastModified": "2024-04-26T15:25:47.270",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 10.0,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-22T20:15:07.803",
        "references": [
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://github.com/airbus-cert/CVE-2024-4040"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Press/Media Coverage",
              "Third Party Advisory"
            ],
            "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Press/Media Coverage",
              "Third Party Advisory"
            ],
            "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
          },
          {
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "tags": [
              "Patch",
              "Press/Media Coverage",
              "Third Party Advisory"
            ],
            "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
          }
        ],
        "sourceIdentifier": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1336"
              }
            ],
            "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2024-4040

Vulnerability from fkie_nvd - Published: 2024-04-22 20:15 - Updated: 2025-11-04 14:36

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://github.com/airbus-cert/CVE-2024-4040	Exploit, Third Party Advisory
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/	Press/Media Coverage, Third Party Advisory
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update	Patch, Vendor Advisory
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update	Patch, Vendor Advisory
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/	Third Party Advisory
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/	Exploit, Issue Tracking
430a6cef-dc26-47e3-9fa8-52fb7f19644e	https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/	Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/airbus-cert/CVE-2024-4040	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/	Press/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/	Exploit, Issue Tracking
af854a3a-2127-422b-91ae-364da2661108	https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/	Issue Tracking, Patch
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040	US Government Resource

Impacted products

	Vendor	Product	Version
	crushftp	crushftp	*
	crushftp	crushftp	*

JSON

To clipboard

{
  "cisaActionDue": "2024-05-01",
  "cisaExploitAdd": "2024-04-24",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "CrushFTP VFS Sandbox Escape Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1922C854-D367-44B7-AEFB-4AEB07679E16",
              "versionEndExcluding": "10.7.1",
              "versionStartIncluding": "10.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EF482D8-4F40-454D-9A92-9D6924C582E2",
              "versionEndExcluding": "11.1.0",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.\n"
    },
    {
      "lang": "es",
      "value": "VFS Sandbox Escape en CrushFTP en todas las versiones anteriores a 10.7.1 y 11.1.0 en todas las plataformas permite a atacantes remotos con privilegios bajos leer archivos del sistema de archivos fuera de VFS Sandbox."
    }
  ],
  "id": "CVE-2024-4040",
  "lastModified": "2025-11-04T14:36:21.647",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-04-22T20:15:07.803",
  "references": [
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/airbus-cert/CVE-2024-4040"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Press/Media Coverage",
        "Third Party Advisory"
      ],
      "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
    },
    {
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/airbus-cert/CVE-2024-4040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Press/Media Coverage",
        "Third Party Advisory"
      ],
      "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040"
    }
  ],
  "sourceIdentifier": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "430a6cef-dc26-47e3-9fa8-52fb7f19644e",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-46VF-C8GJ-2PGQ

Vulnerability from github – Published: 2024-04-22 21:31 – Updated: 2025-10-22 00:33

Details

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

Severity ?

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-4040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1336",
      "CWE-20",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-22T20:15:07Z",
    "severity": "HIGH"
  },
  "details": "VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.",
  "id": "GHSA-46vf-c8gj-2pgq",
  "modified": "2025-10-22T00:33:00Z",
  "published": "2024-04-22T21:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4040"
    },
    {
      "type": "WEB",
      "url": "https://github.com/airbus-cert/CVE-2024-4040"
    },
    {
      "type": "WEB",
      "url": "https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040"
    },
    {
      "type": "WEB",
      "url": "https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update"
    },
    {
      "type": "WEB",
      "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
    },
    {
      "type": "WEB",
      "url": "https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise"
    },
    {
      "type": "WEB",
      "url": "https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual"
    },
    {
      "type": "WEB",
      "url": "https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-0944

Vulnerability from csaf_certbund - Published: 2024-04-21 22:00 - Updated: 2024-04-25 22:00

Summary

CrushFTP: Schwachstelle ermöglicht Codeausführung mit administrativen Rechten

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

CrushFTP ist eine File-Transfer Software für verschiedene Plattformen.

Angriff

Ein entfernter Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um Code mit administrativen Rechten auszuführen

Betroffene Betriebssysteme

- Linux - MacOS X - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "CrushFTP ist eine File-Transfer Software f\u00fcr verschiedene Plattformen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann eine Schwachstelle in CrushFTP ausnutzen, um Code mit administrativen Rechten auszuf\u00fchren",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0944 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0944.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0944 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0944"
      },
      {
        "category": "external",
        "summary": "CrushFTP Security Advisory/Notification/Bulletin vom 2024-04-21",
        "url": "https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update"
      }
    ],
    "source_lang": "en-US",
    "title": "CrushFTP: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung mit administrativen Rechten",
    "tracking": {
      "current_release_date": "2024-04-25T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:08:03.662+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-0944",
      "initial_release_date": "2024-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-04-22T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt, Bewertung angepasst, aktive Ausnutzung aufgenommen"
        },
        {
          "date": "2024-04-25T22:00:00.000+00:00",
          "number": "3",
          "summary": "Text und Bewertung angepasst"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cv11.1.0",
                "product": {
                  "name": "CrushFTP CrushFTP \u003cv11.1.0",
                  "product_id": "T034343"
                }
              }
            ],
            "category": "product_name",
            "name": "CrushFTP"
          }
        ],
        "category": "vendor",
        "name": "CrushFTP"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-4040",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in CrushFTP. Eine serverseitige Template-Injection-Schwachstelle erm\u00f6glicht es nicht authentifizierten Angreifern, Dateien aus dem Dateisystem au\u00dferhalb der VFS-Sandbox zu lesen, die Authentifizierung zu umgehen, um administrativen Zugriff zu erhalten und Remotecode auf dem Server auszuf\u00fchren."
        }
      ],
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2024-4040"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-4040 (GCVE-0-2024-4040)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

GSD-2024-4040

FKIE_CVE-2024-4040

GHSA-46VF-C8GJ-2PGQ

WID-SEC-W-2024-0944

Tags

Sightings

Nomenclature