Vulnerability

CERT-In Vulnerability Note CIVN-2025-0253
Authentication Bypass Vulnerability in CrushFTP

Original Issue Date:October 09, 2025

Severity Rating: CRITICAL

Software Affected

CrushFTP version 10 prior to 10.8.4
CrushFTP version 11 prior to 11.3.1

Overview

A vulnerability has been reported in CrushFTP that could allow a remote attacker to bypass authentication and gain unauthorised access on the targeted system.

Target Audience:
All organisations and individuals are using vulnerable versions of CrushFTP.

Risk Assessment:
High risk of unauthorised access and potential information disclosure.

Impact Assessment:
Potential for system compromise.

Description

CrushFTP is a server application used for secure file transfer over multiple protocols such as FTP, SFTP, and HTTPS.

The vulnerability exists due to a race condition in the AWS4-HMAC authorisation method within the HTTP component. A remote attacker can exploit this flaw by sending specially crafted HTTP POST requests to the /WebInterface/function/ endpoint.

Successful exploitation of this vulnerability could enable a remote attacker to bypass authentication and gain unauthorised access to the targeted system.

Note: This vulnerability( CVE-2025-31161) is being exploited in the wild.

Solution

Apply appropriate updates as provided by vendor:
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update

Vendor Information

https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update

References

NIST
https://nvd.nist.gov/vuln/detail/CVE-2025-31161

CENSYS
https://censys.com/advisory/cve-2025-31161

CVE Name
CVE-2025-31161

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India