A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.

CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Researchers say over 1,400 CrushFTP publicly accessible servers are vulnerable. Proof-of-concept is available. Update to a fixed version as soon as possible.

Exploited in the wild as a zero-day in targeted attacks. Exploit probing observed by vendor. Customers advised to upgrade to a fixed version as soon as possible.

The CrushFTP application installed on the remote host is missing a vendor-supplied patch. It is, therefore, affected by a sandbox escape vulnerability. VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

The CrushFTP application installed on the remote host is missing a vendor-supplied patch. It is, therefore, affected by a sandbox escape vulnerability. VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CrushFTP versions prior to 10.7.1 and 11.x < 11.1.0 are vulnerable to a "VFS Sandbox Escape" allowing a remote attacker with low privileges to read files from the file system outside the sandbox.

ID	Name	Product	Family	Severity
193917	CrushFTP < 10.7.1 / 11.x < 11.1.0 Sandbox Escape (CVE-2024-4040) (Direct Check)	Nessus	Web Servers	critical
193818	CrushFTP < 10.7.1 / 11.x < 11.1.0 Sandbox Escape (CVE-2024-4040)	Nessus	FTP	critical
114273	CrushFTP < 10.7.1 / 11.x < 11.1.0 VFS Sandbox Escape	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-4040

critical

Tenable Plugins

critical

critical

critical