CrushFTP is a proprietary multi-protocol, multi-platform file transfer server.
CVE-2024-4040 - A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read any files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
Affected versions: CrushFTP versions before 10.7.1 and 11.1.0
Usage: python3 exploit.py -u -p
Usage example: python3 exploit.py -u http://127.0.0.1 -p 8080
Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited.
References: https://nvd.nist.gov/vuln/detail/CVE-2024-4040 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/ https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/