CrushFTP VFS Sandbox Escape / Server-Side Template Injection
- Product
- CrushFTP CrushFTP
- CVE
- CVE-2024-4040
- Disclosed
- 2024-04-19
- CVSS
- 10
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- CrushFTP 10 before 10.7.1, 11 before 11.1.0, and all legacy 9.x.
- Fixed
- 10.7.1, 11.1.0.
Summary
A server-side template injection in CrushFTP let unauthenticated users escape the virtual filesystem sandbox, read arbitrary files, bypass authentication and gain admin access. It was exploited as a zero-day in targeted attacks.
Root cause
Certain web interface command parameters are processed for template tags before being used. An INCLUDE tag in a parameter makes the server substitute the contents of an arbitrary file from disk, escaping the user's VFS; this works with an anonymous session token and can leak session data to gain admin access.
Impact
Unauthenticated arbitrary file read, admin takeover and potential code execution.
Detection
grep CrushFTP logs for '<INCLUDE>'; Airbus CERT published log and host scanners.
Mitigation
Upgrade, and use a DMZ instance with restricted file access.