CrushFTP Authentication Bypass and Admin Account Takeover Vulnerability (CVE-2025-31161) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCrushFTP 10 before 10.8.4 and CrushFTP 11 before 11.3.1
Unauthenticated attackers can bypass authentication via HTTP(S) ports to take over the 'crushadmin' account and fully compromise the system
Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official vendor updates immediately using the built-in update mechanism or command-line interface.
# Navigate to the CrushFTP installation directory and run the update utility
cd /var/opt/CrushFTP11/
java -jar CrushFTP.jar -update
# Restart the service to apply changes
systemctl restart crushftp2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the HTTP/HTTPS ports of the CrushFTP server using firewall rules.
# Restrict access to CrushFTP web ports (e.g., 8080, 8443) to trusted IP ranges only
iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 8443 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP3. Log Audit & IoC Verification Commands
Inspect the CrushFTP logs for signs of exploitation, specifically looking for index-out-of-bounds exceptions associated with AWS4-HMAC requests.
# Search for IndexOutOfBoundsException and AWS4-HMAC patterns in the logs
grep -ri 'IndexOutOfBoundsException' /var/opt/CrushFTP11/logs/
grep -ri 'AWS4-HMAC' /var/opt/CrushFTP11/logs/ | grep -i 'crushadmin'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-31161) is a critical authentication bypass residing in the AWS4-HMAC (S3 compatible) authorization handler of the CrushFTP HTTP component. The root cause lies in a logical flaw where the server calls 'login_user_pass()' without requiring a password to verify user existence. When a specially crafted AWS4-HMAC header containing a username followed by a slash (/) is processed, the server successfully identifies the user and initiates the 'anypass' authentication flow. However, it subsequently fails to locate the expected 'SignedHeaders' entry, triggering an 'index-out-of-bounds' exception. This unhandled exception abruptly halts execution, preventing the session cleanup routine from running and leaving the session in an authenticated state.
2. Exploitation Mechanics & Attack Scenario
While initially identified as a race condition in the AWS4-HMAC verification process, threat actors discovered a deterministic exploitation vector using mangled headers. An attacker sends an HTTP request with an 'Authorization' header containing a trailing slash after the target username (e.g., 'crushadmin/'). The server processes the username, validates it, but crashes during the header parsing phase. Because the exception bypasses the session destruction logic, the attacker's session remains active and fully authenticated as the target user. This allows trivial, reliable takeover of administrative accounts without brute-forcing passwords.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability poses an extreme risk and has been actively exploited in the wild, leading to its inclusion in the CISA KEV catalog. Successful exploitation grants full administrative access ('crushadmin') to the FTP server. Attackers can exfiltrate sensitive corporate data, modify system configurations, or leverage administrative privileges to execute arbitrary code (RCE) on the underlying operating system, potentially leading to full network compromise and ransomware deployment.
Official Vendor Advisories & References
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
Frequently Asked SecOps Questions (CVE-2025-31161)
FAQQ1. How critical is CVE-2025-31161 and is it actively exploited in the wild?
CVE-2025-31161 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-31161?
Primary impacted vendors include crushftp across crushftp. Scope summary: CrushFTP 10 (before 10.8.4) and CrushFTP 11 (before 11.3.1). Systems utilizing a DMZ proxy instance are partially mitigated against direct external takeover.
Q3. What temporary mitigations or workarounds exist for CVE-2025-31161 before patching?
[Mitigation] Immediately upgrade CrushFTP to version 10.8.4 / 11.3.1 or later, and enforce DMZ proxy configurations Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-31161
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (crushftp)
View Category →PaperCut MF/NG Web Management Interface Improper Access Control Vulnerability (CVE-2026-81578) Advisory
[Affected Scope] Web management interface of PaperCut MF and PaperCut NG.
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.