An error exposes secrets from over 3,400 servers across the network.
CrushFTP has notified its users of a critical vulnerability in its file transfer system that allows attackers to gain unauthenticated access to a server via open HTTP(S) ports. The vulnerability affects servers accessible from the Internet and requires immediate updating.According to a letter sent to clients on March 21, 2025, the vulnerability was discovered in all versions of CrushFTP v11. The letter stated that earlier versions were not affected. However, a security recommendation published on the same day contradicts this assertion, indicating that the vulnerability is also present in version v10. The issue was first reported by Rapid7, which raised further concerns among clients.
The core problem is that if an HTTP(S) port is left open, a hacker can gain access to the server without undergoing any authentication process. The solution is either to update to CrushFTP version v11.3.1 or higher, or to activate the DMZ feature, which places the server in a demilitarized zone, thereby reducing the risk of exploitation.
The company emphasized that clients should install the update immediately. For those unable to update right away, it is recommended to enable the DMZ functionality as a temporary protective measure until a patch is released. CrushFTP has promised to register the vulnerability in the CVE database soon, which will allow its status and spread to be officially tracked.
CrushFTP Instances Accessible via the Internet (Shodan)
According to Shodan, more than 3,400 CrushFTP servers currently have publicly accessible web interfaces, making them potential targets. It is unclear how many of these have already been updated.
This is not the first time CrushFTP has encountered serious security issues. In April 2024, the company had already addressed a zero-day vulnerability (CVE-2024-4040) that was actively exploited by attackers. At that time, the attacks aimed to bypass the isolated file system and upload system files, and were linked to politically motivated espionage activity targeting American organizations.
