CVE-2025-31161
CrushFTP Authentication Bypass Vulnerability
Description
CVE-2025-31161 is a critical authentication bypass vulnerability in CrushFTP, a widely deployed file transfer server, affecting versions 10 before 10.8.4 and 11 before 11.3.1. The vulnerability allows an unauthenticated remote attacker to take over the built-in crushadmin account through a race condition in the AWS4-HMAC (S3-compatible) authorization method, which can be trivially stabilized by sending a malformed authorization header. With a CVSS v3.1 score of 9.8 and confirmed use in ransomware campaigns, CVE-2025-31161 was actively exploited in March and April 2025 before being added to CISA's Known Exploited Vulnerabilities catalog. Its EPSS score of 88.0% at the 99th percentile places it among the most exploited vulnerabilities globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| crushftp | crushftp | >= 10.0.0, < 10.8.4; >= 11.0.0, < 11.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo(Vendor Advisory)
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/(Third Party Advisory)
- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis(Exploit, Third Party Advisory)
- https://projectdiscovery.io/blog/crushftp-authentication-bypass(Exploit, Third Party Advisory)
- https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation(Press/Media Coverage)
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation(Exploit, Third Party Advisory)
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/(Press/Media Coverage)
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161(US Government Resource)
Weakness Type
CWE-305: Authentication Bypass by Primary Weakness
CVE-2025-31161 is classified under CWE-305 (Authentication Bypass by Primary Weakness), where the primary authentication mechanism contains a flaw that allows it to be circumvented entirely. In CrushFTP, the AWS4-HMAC authorization handler first verifies user existence by calling login_user_pass() without a password requirement, authenticating the session through the HMAC process. A subsequent verification step is intended to clean up the session, but this can be bypassed through a race condition or a malformed header that triggers an index-out-of-bounds error, preventing session cleanup and leaving the attacker fully authenticated.
Learn more: CWE-305 — Authentication Bypass by Primary Weakness
Impact Analysis
CVE-2025-31161 carries the maximum practical CVSS v3.1 base score of 9.8 (Critical), reflecting its devastating potential. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N). Confidentiality, integrity, and availability are all rated High because an attacker can authenticate as the crushadmin superuser, gaining complete administrative control over the CrushFTP server. This includes access to all files managed by the server, the ability to create additional administrative accounts, modify server configurations, exfiltrate data, and deploy malicious payloads. The EPSS score of 88.0% at the 99th percentile confirms near-certain exploitation. Ransomware operators are known to exploit this vulnerability, following the established pattern of targeting file transfer platforms for data theft and extortion.
Exploit Maturity
CVE-2025-31161 demonstrates maximum exploit maturity with widespread active exploitation confirmed since March 2025. CISA has added it to the Known Exploited Vulnerabilities catalog with ransomware association classified as Known. Public exploit code and detailed analysis are available from multiple sources including attackerkb.com, projectdiscovery.io, huntress.com. The EPSS score of 88.0% at the 99th percentile indicates very high likelihood of exploitation. Multiple security firms have published detailed exploitation walkthroughs, and the attack is trivially reproducible by sending a single malformed HTTP request with a crafted AWS4-HMAC authorization header containing only a username followed by a slash character. The combination of trivial exploitation, no authentication requirement, and direct administrative access makes this one of the most dangerous file transfer vulnerabilities in recent history.
Remediation
-
Upgrade CrushFTP immediately to version 10.8.4 or later (for CrushFTP 10.x) or version 11.3.1 or later (for CrushFTP 11.x). The vendor advisory provides specific upgrade instructions.
-
If patching is not immediately possible, deploy a DMZ proxy in front of the CrushFTP server. The vendor has confirmed that the vulnerability cannot be exploited when a DMZ proxy instance is used, as the proxy handles authentication separately from the main server.
-
Conduct immediate forensic investigation on all CrushFTP servers that were running vulnerable versions while internet-accessible. Search for unauthorized administrative sessions, new user accounts, modified configurations, file access audit logs showing suspicious activity, and web shells or unauthorized files on the server.
-
Reset all CrushFTP administrative credentials including the crushadmin account password, and review all user accounts for unauthorized additions or privilege changes. Assume that any internet-exposed CrushFTP server running a vulnerable version has been compromised.
-
Implement network-level controls including restricting CrushFTP management interface access to trusted IP ranges, deploying intrusion detection signatures for the malformed AWS4-HMAC header pattern, and monitoring for indicators of ransomware activity across systems accessible from the CrushFTP server.
Technical Details
CVE-2025-31161 is an authentication bypass vulnerability in CrushFTP's HTTP component, specifically in the AWS4-HMAC (S3-compatible) authorization method. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms this is a network-accessible, unauthenticated attack with maximum impact. The vulnerability involves two interrelated flaws. First, when processing AWS4-HMAC authorization headers, the server calls login_user_pass() to verify user existence without requiring a password, which inadvertently authenticates the session. A subsequent check is supposed to verify the HMAC signature and clean up unauthorized sessions, creating a race condition window where the session remains valid. Second, and more critically, by sending a malformed AWS4-HMAC header containing only a username followed by a slash (/) and no SignedHeaders entry, the server successfully finds and authenticates the user but then encounters an index-out-of-bounds error when trying to parse the SignedHeaders field. This error halts execution before the session cleanup code runs, permanently leaving the attacker's session authenticated. By targeting the crushadmin username, which exists on all CrushFTP installations, an attacker gains full administrative control with a single HTTP request.
Frequently Asked Questions
Is CVE-2025-31161 being actively exploited?
Yes. CVE-2025-31161 has been actively exploited since March 2025, with confirmed use in ransomware campaigns. CISA's KEV catalog entry classifies the ransomware association as Known. Multiple security firms have documented widespread exploitation activity.
What products are affected by CVE-2025-31161?
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected. The vulnerability is fixed in CrushFTP 10.8.4 and 11.3.1 respectively.
How do I fix CVE-2025-31161?
Upgrade to CrushFTP 10.8.4+ or 11.3.1+ immediately. If immediate patching is not possible, deploy a DMZ proxy in front of the CrushFTP server, which mitigates the vulnerability by handling authentication separately.
How severe is CVE-2025-31161?
CVE-2025-31161 is rated Critical with a CVSS score of 9.8. It allows unauthenticated remote attackers to gain full administrative access through a single HTTP request. Combined with its confirmed ransomware exploitation and EPSS score of 88.0%, this is one of the most dangerous vulnerabilities in the file transfer space.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.