CVE-2024-4040
CrushFTP VFS Sandbox Escape Vulnerability
Description
CVE-2024-4040 is a critical server-side template injection (SSTI) vulnerability in CrushFTP affecting all versions before 10.7.1 and 11.1.0 across all platforms. The vulnerability allows unauthenticated remote attackers to read arbitrary files outside the virtual file system (VFS) sandbox, bypass authentication to gain administrative access, and achieve remote code execution on the server. With a CVSS v3.1 base score of 9.8, this represents a complete compromise of the CrushFTP server without any authentication requirements. CISA has added CVE-2024-4040 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 1, 2024, and its EPSS score of 94.43% at the 100th percentile indicates that this vulnerability has the highest possible exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| crushftp | crushftp | >= 10.0.0, < 10.7.1; >= 11.0.0, < 11.1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/airbus-cert/CVE-2024-4040(Exploit, Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/(Press/Media Coverage, Third Party Advisory)
- https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update(Patch, Vendor Advisory)
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update(Patch, Vendor Advisory)
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/(Third Party Advisory)
- https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/(Exploit, Issue Tracking)
- https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/(Issue Tracking, Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040(US Government Resource)
Weakness Type
Server-Side Template Injection (SSTI)
CVE-2024-4040 is a server-side template injection vulnerability in CrushFTP's web interface. Server-side template injection occurs when user-controlled input is embedded into a server-side template engine without proper sanitization, allowing an attacker to inject template directives that are executed on the server. In CrushFTP's implementation, the template engine processes user requests and renders dynamic web pages, but fails to properly restrict or sanitize template expressions in certain input parameters. This allows an attacker to inject malicious template code that is interpreted and executed by the server's template engine, bypassing the VFS sandbox, authentication mechanisms, and achieving arbitrary code execution. This weakness maps to CWE-94 (Improper Control of Generation of Code), which describes the broader class of code injection vulnerabilities where user input is incorporated into dynamically generated code. Learn more about CWE-94
Impact Analysis
The impact of CVE-2024-4040 is catastrophic, with maximum ratings across all CIA triad dimensions. Confidentiality is fully compromised because the vulnerability allows unauthenticated file reads outside the VFS sandbox, exposing the entire server filesystem including configuration files, database credentials, TLS private keys, user data stored on the CrushFTP server, and any other sensitive files accessible to the CrushFTP process. The authentication bypass further expands access to all administrative functions, user accounts, and transfer logs.
Integrity faces maximum impact as the remote code execution capability allows the attacker to modify any file on the server, alter CrushFTP configurations, inject backdoors, manipulate files being transferred through the platform, create rogue administrator accounts, and install persistent access mechanisms.
Availability is at maximum risk because remote code execution enables the attacker to shut down the CrushFTP service, corrupt data, deploy ransomware, or use the compromised server as a launchpad for attacks against connected systems. The attack requires no authentication (PR:N), no user interaction (UI:N), and can be executed remotely (AV:N) with low complexity (AC:L). The EPSS score of 94.43% at the 100th percentile is the absolute maximum exploitation probability, meaning this vulnerability is being exploited more extensively than virtually every other known vulnerability. CISA classifies the ransomware association as "Unknown," but file transfer platforms are primary targets for ransomware and extortion operations, as demonstrated by previous campaigns targeting MOVEit, GoAnywhere, and other file transfer solutions.
Exploit Maturity
CVE-2024-4040 has reached maximum exploit maturity with multiple public exploit resources and widespread active exploitation. A proof-of-concept exploit is available on GitHub from Airbus CERT, and exploitation details have been extensively discussed on community platforms including Reddit's CrowdStrike community and cybersecurity forums.
CISA added CVE-2024-4040 to the KEV catalog with an aggressive remediation deadline, reflecting the severity and breadth of exploitation. Rapid7 published a detailed analysis characterizing it as a zero-day that enables complete server compromise. BleepingComputer reported that CrushFTP issued urgent warnings to users about immediate exploitation. The EPSS score of 94.43% at the 100th percentile confirms the highest possible exploitation probability. File transfer platforms have become primary targets for threat actors, particularly ransomware and extortion groups, following successful campaigns against similar products. The ransomware association is classified as "Unknown" by CISA, but the vulnerability profile closely mirrors those exploited in previous mass-exploitation events targeting file transfer infrastructure.
Remediation
-
Upgrade CrushFTP immediately to version 10.7.1 or later for installations on the 10.x branch, or to version 11.1.0 or later for installations on the 11.x branch. Upgrade instructions are available on the CrushFTP wiki pages for version 10 and version 11. This is an emergency-level patch that should be applied outside of normal change windows.
-
Restrict network access to the CrushFTP web interface immediately as a compensating control if patching cannot be performed right away. Use firewall rules to limit access to the management and file transfer interfaces to known trusted IP ranges. Consider placing CrushFTP behind a reverse proxy with web application firewall (WAF) capabilities that can block template injection payloads.
-
Conduct a forensic investigation of all CrushFTP servers that were running vulnerable versions. Examine access logs for unusual requests, particularly those containing template injection syntax or attempts to access files outside the VFS. Check for unauthorized user accounts, modified configurations, newly created files, and evidence of data exfiltration.
-
Rotate all credentials and secrets accessible from or stored on the CrushFTP server. This includes CrushFTP administrator passwords, user credentials, TLS certificates and private keys, database connection strings, API tokens, and any other secrets that were stored on or accessible through the compromised server.
-
Implement monitoring and alerting for CrushFTP servers, including file integrity monitoring for configuration and system files, network traffic analysis for unusual outbound connections, and log monitoring for authentication anomalies and unauthorized administrative actions.
Technical Details
CVE-2024-4040 is a server-side template injection vulnerability in CrushFTP affecting versions prior to 10.7.1 and 11.1.0. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a base score of 9.8 (Critical).
CrushFTP uses a server-side template engine to render dynamic web pages for its web-based file transfer interface. The vulnerability exists because certain user-supplied input parameters are incorporated into template expressions without proper sanitization or sandboxing. An unauthenticated attacker can inject malicious template directives that are interpreted and executed by the server-side template engine with the privileges of the CrushFTP process.
The exploitation chain enables three distinct attack capabilities. File read beyond VFS sandbox: The template injection allows the attacker to read arbitrary files from the server's filesystem, bypassing CrushFTP's Virtual File System (VFS) restrictions that normally confine file access to designated directories. This exposes system configuration files, credentials, and any data stored on the server. Authentication bypass: The template injection can be leveraged to manipulate the authentication logic, granting the attacker administrative access without providing valid credentials. This provides access to all administrative functions including user management, server configuration, and transfer monitoring. Remote code execution: The template engine provides sufficient functionality for the attacker to execute arbitrary operating system commands on the server, achieving full remote code execution.
The Attack Vector (AV:N) confirms fully remote exploitation with no physical or local access required. Attack Complexity (AC:L) is low, as the exploit requires only a crafted HTTP request to the CrushFTP web interface. Privileges Required (PR:N) is none, making this a fully unauthenticated attack. User Interaction (UI:N) is none, enabling fully automated exploitation. The Scope (S:U) is unchanged, though the practical impact extends to all connected systems. All CIA metrics are rated high (C:H/I:H/A:H), reflecting complete server compromise. Affected versions include CrushFTP 10.0.0 through 10.7.0 and CrushFTP 11.0.0 through 11.0.x.
Frequently Asked Questions
What is CVE-2024-4040?
CVE-2024-4040 is a critical server-side template injection vulnerability in CrushFTP that allows unauthenticated attackers to read arbitrary files, bypass authentication, and execute remote code on the server. It affects all CrushFTP versions before 10.7.1 and 11.1.0.
How likely is exploitation of CVE-2024-4040?
Exploitation probability is at the absolute maximum. The EPSS score of 94.43% at the 100th percentile means this vulnerability is being exploited more extensively than virtually every other known vulnerability. Public exploit code is available, and CISA has confirmed active exploitation.
Is my CrushFTP server at risk?
If your CrushFTP server is running any version before 10.7.1 (for the 10.x branch) or 11.1.0 (for the 11.x branch), it is vulnerable. The attack requires no authentication and can be performed by anyone who can reach the CrushFTP web interface.
Why are file transfer platforms frequently targeted?
File transfer platforms store and transmit sensitive organizational data and are often internet-facing to support external file exchange. This combination of valuable data, network accessibility, and the potential for mass data exfiltration makes them prime targets for ransomware operators and data extortion groups, as demonstrated by campaigns targeting MOVEit, GoAnywhere, and now CrushFTP.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.