Unauthenticated arbitrary file read and remote code execution in CrushFTP (CVE-2024-4040)

What is affected, what to do

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

The vulnerability is being actively exploited; treat it as a priority. Update CrushFTP to version 10.7.1, CrushFTP to version 11.1.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• CrushFTP lt 10.0..10.7.1
• CrushFTP lt 11.0..11.1.0

Fixed in

• CrushFTP 10.7.1
• CrushFTP 11.1.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: upgrade CrushFTP to 10.7.1 (10.x branch) or 11.1.0 (11.x branch), or any later release. This is the only complete fix — public exploit code exists and the flaw is unauthenticated over HTTP/HTTPS.
   • If patching within hours is not feasible, pull the WebInterface (TCP/443, TCP/80, default admin TCP/9090) off the internet or force it behind a reverse proxy/WAF with strict request validation. Do not leave it bound to 0.0.0.0.
   • Deploy the vendor-recommended DMZ instance in front of the production CrushFTP server to reduce direct VFS exposure of sensitive data stores.
   • Rotate all administrator credentials, API keys and session tokens after patching. Successful exploitation bypasses authentication and grants admin access, so existing secrets must be considered compromised.
   • Inspect the server filesystem and VFS configuration for signs of prior exfiltration: /etc/passwd, SSH keys, and CrushFTP configuration files (users.XML, serversettings.properties) are prime targets.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place CrushFTP hosts in a dedicated DMZ VLAN and restrict outbound traffic to a whitelist of backend destinations to kill reverse shells and payload staging after RCE.
   • WAF/reverse-proxy rule: block requests containing server-side template injection markers in URL and body — especially /WebInterface/function/ paths carrying template delimiters in user-controlled fields.
   • Harden the CrushFTP instance: bind the admin interface to a separate port exposed only to a management VLAN, disable the default admin account, and restrict per-user VFS access to the minimum paths required.
   • Filesystem hardening: run the CrushFTP process under an unprivileged service account and enforce chroot/AppArmor/SELinux so that a VFS escape cannot expose the whole host filesystem.
   • IAM: use dedicated credentials for the CrushFTP service account, never reuse domain credentials for backend integrations, and enforce MFA on every administrative WebInterface login.
   • Egress filtering: block outbound traffic from the CrushFTP host to known C2 infrastructure and TOR exit nodes, and enable full DNS query logging.
3. 03

   Runbook step 3

   Detection rules

   • Review web-server/reverse-proxy logs for unauthenticated requests to /WebInterface/function/ endpoints with unusual parameter payloads or template delimiters. Sigma shape: selection: cs-uri-stem|contains: '/WebInterface/function/' AND cs-uri-query|re: '(\\$\\{|<%|\\{\\{)'.
   • EDR/Sysmon (EID 1) process ancestry: the CrushFTP Java process spawning cmd.exe, powershell.exe, /bin/sh, /bin/bash, curl or wget is abnormal. KQL shape: DeviceProcessEvents | where InitiatingProcessFileName has "java" and InitiatingProcessCommandLine has "crushftp" and FileName in~ ("cmd.exe","powershell.exe","bash","sh","curl","wget").
   • File access outside the configured VFS roots: Linux auditd on open/openat syscalls by the CrushFTP UID touching /etc/, /root/, or /home/*/.ssh/; on Windows watch for access to C:\Windows\System32\config, SAM, or registry hives.
   • Network telemetry (Zeek/Suricata): outbound connections from the CrushFTP host to previously unseen external IPs within 60 seconds of an inbound POST to the WebInterface — correlate as a single alert.
   • CrushFTP's own audit logs: admin login events without a preceding failed login or normal session handshake, plus any newly created user with administrative privileges, should be flagged for review.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), pwn.watch, cvelistv5

Vendors and products

• CrushFTP CrushFTP

Weakness classes (CWE)

• CWE-1336Improper Neutralization of Special Elements Used in a Template Engine

  Base

  The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

  Entry at MITRE CWE-1336

References & sources

• crushftp.comcrush11wiki/Wiki.jsp?page=UpdateVendor advisory, Patch, Vendor advisory
• crushftp.comcrush10wiki/Wiki.jsp?page=UpdateVendor advisory, Patch, Vendor advisory
• reddit.comr/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_…related, Issue tracking, Patch
• bleepingcomputer.comnews/security/crushftp-warns-users-to-patch-exploited-zero-day-…media-coverage, Press coverage, Third-party advisory
• reddit.comr/crowdstrike/comments/1c88788/situational_awareness_20240419_c…Third-party advisory, Exploit, Issue tracking
• rapid7.comblog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enab…Third-party advisory, Third-party advisory
• github.comairbus-cert/CVE-2024-4040Exploit, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040government-resource, US government resource
• pwn.watchpwn.watch: CrushFTP VFS Sandbox Escapepwn-watch
• crushftp.comCrushFTP advisory: CVE-2024-4040pwn-watch
• NVD (NIST)NVD: CVE-2024-4040pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch