CrushFTP Authentication Bypass Vulnerability (CVE-2025-31161)

What is affected, what to do

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update CrushFTP to version 10.8.4, CrushFTP to version 11.3.1. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• CrushFTP lt 10..10.8.4
• CrushFTP lt 11..11.3.1

Fixed in

• CrushFTP 10.8.4
• CrushFTP 11.3.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Upgrade CrushFTP 10 to 10.8.4 or later and CrushFTP 11 to 11.3.1 or later. Apply via the built-in updater or the vendor package, restart the service, and confirm the version string in the WebInterface.
   • Cut exposure if you can't patch within hours: Restrict the WebInterface HTTP(S) listeners at the perimeter to known partner IPs. Common defaults are 8080/443, but verify the actual ports in the server configuration. Otherwise, take the instance offline.
   • Assume compromise and hunt: Exploitation predates broad patch availability. Review the following for unauthorised changes:
     • user files under users/MainUsers/
     • newly created accounts
     • modified permissions
     • new VFS mappings
   • Rotate credentials: Reset crushadmin and every admin account first, then all remaining users. Also rotate any stored backend credentials (S3, SMB, SFTP targets) and service accounts configured in CrushFTP.
   • Kill live sessions: Invalidate existing sessions and CrushAuth cookies with a service restart. Before logs roll over, preserve session and login logs from March 2025 onward for forensics.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Front the internal server with a CrushFTP DMZ proxy instance. Per the CVE description, crushadmin takeover does not work when a DMZ proxy is in use. Make the internal server reachable only from the DMZ node.

   • WAF/IPS rule: Drop or alert on Authorization: AWS4-HMAC-SHA256 headers where

     • the Credential= value ends in / right after the username, or
     • SignedHeaders= is missing.

     If you don't use the S3-compatible interface, block AWS4-HMAC headers at the reverse proxy entirely. Suricata sketch: alert http any any -> $CRUSHFTP any (msg:"CVE-2025-31161 AWS4-HMAC without SignedHeaders"; http.header; content:"AWS4-HMAC"; nocase; content:!"SignedHeaders"; sid:9000001;).

   • Admin surface: Use CrushFTP's IP restrictions to limit admin access to a management network. Rename crushadmin or replace it with named admin accounts so the target username isn't guessable.

   • Endpoint hardening: Run the CrushFTP service under a low-privilege service account, not SYSTEM/root. Use EDR or AppLocker to block the Java process from spawning shells or script interpreters.

   • Egress control: Restrict outbound traffic from the FTP server to required destinations. This hampers remote-management tool staging and data exfiltration.

3. 03

   Runbook step 3

   Detection rules

   • Reverse proxy/WAF logs: Look for AWS4-HMAC-SHA256 Credential=<user>/ with no trailing signature fields, especially where <user> is crushadmin. Header logging must be enabled for this. Grep sketch: grep -E 'AWS4-HMAC-SHA256 Credential=[A-Za-z0-9_.-]+/[",]' proxy.log.
   • CrushFTP application logs (CrushFTP.log, session logs): Watch for successful logins with no preceding password check, quickly followed by /WebInterface/function/ calls with command=getUserList, setUserItem or setServerItem. Admin logins from unfamiliar source IPs are also suspicious.
   • File integrity monitoring: Alert on writes to users/MainUsers/*/user.XML and on new user directories. On Windows, use Sysmon EID 11; on Linux, use the auditd watch -w <crushftp>/users/ -p wa -k crushftp_users.
   • EDR process ancestry: Flag java/CrushFTPService spawning cmd.exe, powershell.exe, sh or bash. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","javaw.exe","CrushFTPService.exe") and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe").
   • Network telemetry (Zeek): Watch for unusually large outbound transfers from the FTP server and new connections to remote-management or tunnelling services. A burst of alternating HTTP 401/200 responses on the WebInterface may indicate race-condition attempts.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.

Source: NCSC NZ (CC BY 4.0), pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• CrushFTP CrushFTP

Weakness classes (CWE)

• CWE-305Authentication Bypass by Primary Weakness

  Base

  The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

  Entry at MITRE CWE-305

References & sources

• outpost24.comblog/crushftp-auth-bypass-vulnerabilityThird-party advisory
• crushftp.comcrush11wiki/Wiki.jsp?page=UpdateVendor advisory
• projectdiscovery.ioblog/crushftp-authentication-bypassExploit, Third-party advisory
• darkreading.comvulnerabilities-threats/disclosure-drama-clouds-crushftp-vulner…Press coverage
• huntress.comblog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitationExploit, Third-party advisory
• attackerkb.comtopics/k0EgiL9Psz/cve-2025-2825/rapid7-analysisExploit, Third-party advisory
• infosecurity-magazine.comnews/crushftp-flaw-exploited-disclosurePress coverage
• vicarius.iovsociety/posts/cve-2025-31161-detect-crushftp-vulnerabilityExploit, Third-party advisory
• vicarius.iovsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerabilityMitigation, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161government-resource, US government resource
• pwn.watchpwn.watch: CrushFTP: Authentication Bypass Vulnerabilitypwn-watch
• crushftp.comCrushFTP advisory: CrushFTPpwn-watch
• NVD (NIST)NVD: CVE-2025-31161pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch