CrushFTP AS2 Validation Authentication Bypass Vulnerability (CVE-2025-54309) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCrushFTP 10 before 10.8.5 and CrushFTP 11 before 11.3.4_23, specifically when the DMZ proxy feature is not utilized.
Unauthenticated remote attackers can bypass AS2 validation via HTTPS to obtain full administrative access, which has been actively exploited in the wild.
Immediately upgrade to CrushFTP 10.8.5, 11.3.4_23, or later, or restrict direct HTTPS access and enable the DMZ proxy feature.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade your CrushFTP instance to version 10.8.5 or 11.3.4_23 or higher using the built-in update mechanism.
# Navigate to the CrushFTP installation directory and run the update command
cd /var/opt/CrushFTP11/
java -jar CrushFTP.jar -update
# Restart the service to apply the security patch
systemctl restart crushftp2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, restrict HTTPS access to trusted IP addresses only and configure the DMZ proxy architecture to shield the main server.
# Restrict HTTPS access (port 443) to a trusted management subnet using iptables
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Inspect the CrushFTP logs for suspicious AS2-related requests and unauthorized administrative session creations.
# Search for AS2-related activities and potential admin session anomalies in the logs
grep -i 'AS2' /var/opt/CrushFTP11/logs/CrushFTP.log
grep -i 'admin' /var/opt/CrushFTP11/logs/CrushFTP.log | grep -E 'Session|Login'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-54309) is a critical authentication bypass in CrushFTP's handling of AS2 (Applicability Statement 2) message validation. When CrushFTP is configured without a DMZ proxy, the application mishandles incoming AS2 validation requests over HTTPS (CWE-420). This flaw allows an attacker to manipulate request parameters to bypass standard authentication checks.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a specially crafted HTTPS request containing malicious AS2 validation parameters directly to the exposed CrushFTP server. Because the DMZ proxy is not intercepting and filtering these requests, the backend server processes the malformed AS2 payload and incorrectly associates the unauthenticated session with administrative privileges, granting the attacker full control over the administrative console.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 and active exploitation confirmed by CISA's KEV catalog, this vulnerability poses an extreme risk. Successful exploitation allows attackers to exfiltrate sensitive files, deploy web shells, execute arbitrary commands, and compromise the entire host infrastructure, leading to severe data breaches and operational disruption.
Official Vendor Advisories & References
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Frequently Asked SecOps Questions (CVE-2025-54309)
FAQQ1. How critical is CVE-2025-54309 and is it actively exploited in the wild?
CVE-2025-54309 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 93.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-54309?
Primary impacted vendors include crushftp across crushftp. Scope summary: CrushFTP 10 prior to 10.8.5 and CrushFTP 11 prior to 11.3.4_23, in standalone configurations without DMZ proxy enabled
Q3. What temporary mitigations or workarounds exist for CVE-2025-54309 before patching?
[Mitigation] Immediately upgrade to CrushFTP 10.8.5, 11.3.4_23, or later, or restrict direct HTTPS access and enable the DMZ proxy feature. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-54309
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (crushftp)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.