Critical Zero-Day Exposes FTP Servers to Attack
CrushFTP Exploited: Hackers Leverage Unpatched Vulnerability for Admin Access
Table of Contents
CrushFTP, a widely used file transfer protocol (FTP) server software, has become the target of cyberattacks, with hackers exploiting a previously fixed vulnerability to gain unauthorized administrative access. The company has issued an advisory urging users to update their software immediately to prevent further compromise.
The Vulnerability and Attack Vector
The exploit targets a bug that CrushFTP had already addressed in earlier versions. Hackers, by reverse-engineering the code, identified this flaw and are actively using it against users who have not updated to the latest software releases.
The primary attack vector appears to be HTTP(S). The National Vulnerability Database (NVD) has assigned the identifier CVE-2025-54309 to this vulnerability. According to the NVD, the exploit occurs when the DMZ proxy feature is not utilized.This misconfiguration leads to improper handling of the Applicability Statement 2 (AS2) protocol,wich is used for transmitting messages. This mishandling, in turn, allows remote attackers to obtain administrative privileges via HTTPS.
Indicators of Compromise and Mitigation
Ryan Emmons, an offensive security engineer and vulnerability researcher at Rapid7, highlighted a key indicator of exploitation: a “last_logins” value set for the internal ‘default’ user account. This specific log entry suggests that the system may have been compromised.
CrushFTP strongly advises its users to implement regular and frequent patching. The company emphasized that users who have kept their software up-to-date are not affected by this exploit. moreover,enterprise customers who have deployed a DMZ CrushFTP instance in front of their main servers are also protected from this particular attack.
Broader Implications and security Best Practices
This incident underscores the critical importance of timely software updates in cybersecurity. Even vulnerabilities that have been patched can pose a meaningful risk if users fail to apply the updates. The exploitation of a known,albeit previously fixed,bug by attackers who reverse-engineer code is a growing concern in the cybersecurity landscape.As highlighted by the advisory and security experts, maintaining current software versions is paramount. For organizations utilizing CrushFTP,ensuring that all instances are running the latest release and that DMZ configurations are properly implemented are crucial steps in safeguarding against such threats. the incident serves as a stark reminder that vigilance and proactive security measures are essential in the ongoing battle against cyber adversaries.