CrushFTP S3 Authorization Header Authentication Bypass
- Product
- CrushFTP CrushFTP
- CVE
- CVE-2025-31161
- Disclosed
- 2025-03-21
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- CrushFTP 10.0.0-10.8.3 and 11.0.0-11.3.0.
- Fixed
- 10.8.4, 11.3.1.
Summary
An authentication bypass in CrushFTP's S3-style authorization handling let unauthenticated attackers impersonate any user, including crushadmin. Exploitation began after details leaked amid a disclosure dispute.
Root cause
When parsing an AWS4-HMAC-style Authorization header, CrushFTP extracts a username and, through a flag intended for internal lookups, skips password verification. A race-condition-like handling of session cookies then lets the attacker obtain a fully authenticated session for the named user.
Impact
Unauthenticated admin access, enabling file theft and code execution via admin features.
Detection
Look for Authorization headers starting with AWS4-HMAC-SHA256 that contain only a username, and new admin accounts. Nuclei template CVE-2025-31161.
Mitigation
Upgrade and enable the DMZ proxy instance.