Exploit for CrushFTP RCE chain released, patch now

A proof-of-concept accomplishment was about appear for a analytical alien cipher beheading vulnerability in the CrushFTP action suite, acceptance counterfeit attackers to acceptance files on the server, assassinate code, and access plain-text passwords.

The vulnerability was apparent in August 2023, tracked as CVE-2023-43177, by Converge aegis researchers, who responsibly appear it to the vendor. The developers appear a fix brief in adaptation CrushFTP 10.5.2.

Today, Converge appear a proof-of-concept exploit for the CVE-2023-43177 flaw, authoritative it analytical for CrushFTP users to install the aegis updates as anon as possible.

Exploiting CrushFTP

The CrushFTP accomplishment is conducted through an counterfeit mass-assignment vulnerability, base the AS2 attack parsing to ascendancy user affair properties.

This allows attackers to apprehend and annul files, potentially arch to complete arrangement ascendancy and root-level alien cipher execution.

The attackers can accelerate payloads to the CrushFTP account on specific ports (80, 443, 8080, 9090) application web headers, which leave log traces.

Next, the attackers overwrite affair abstracts application Java's 'putAll()' function, enabling the clothing of 'administrators,' and advantage the 'drain_log()' action to dispense files as bare to advance stealthiness.

Mass-assignment overwrite of user info (Converge)

Eventually, the attackers can advantage the 'sessions. obj' book in the program's accession binder to annex alive user sessions acceptance to admin accounts, about accomplishing advantaged escalation.

Having accustomed admin access, the antagonist can accomplishment flaws in the admin panel's administration of SQL disciplinarian loading and database agreement testing (testDB) to assassinate approximate Java code.

Vulnerable cipher allowing admin-level RCE (Converge)

Converge has appear a affirmation of the video of the PoC accomplishment in use, as apparent below.

Thousands of accessible devices

According to Converge's report, there are almost 10,000 public-facing CrushFTP instances and acceptable abounding added abaft accumulated firewalls. The advance apparent is ample alike admitting the cardinal of accessible instances hasn't been determined.

File alteration articles like CrushFTP are particularly attractive to ransomware actors, accurately Clop, accepted for leveraging zero-day vulnerabilities in software like the MOVEit Transfer, GoAnywhere MFT, and Accelion FTA to conduct abstracts annexation attacks.

Unfortunately, the advisers appear that alike applying the patches doesn't defended CrushFTP endpoints adjoin all accessible threats.

"Converge's blackmail intelligence indicates that the aegis application has been reverse-engineered, and adversaries accept developed proofs of concepts. Because of that, accessible corruption is likely." - Converge

To bigger abate the risk, it is recommended to chase these steps:

1. Update CrushFTP to the latest version.
2. Enable automated aegis application updates.
3. Change the countersign algorithm to Argon.
4. Audit for crooked users and analysis for contempo countersign changes.
5. Activate the new Limited Server approach for added security.

Additional measures that can be implemented to enhance CrushFTP aegis added include:

• Using a bound advantage operating arrangement account anniversary for CrushFTP.
• Deploying Nginx or Apache as a about-face proxy for public-facing servers.
• Setting firewall rules to absolute CrushFTP cartage to trusted IP ranges and hosts.

It's basic to apparatus these aegis measures as anon as possible, as the about appear accomplishment capacity of CVE-2023-43177 are acceptable to be acclimated by hackers in adept attacks.