Security News > 2024 > April > CrushFTP zero-day exploited by attackers, upgrade immediately! (CVE-2024-4040)
2024-04-23 09:50
A vulnerability in enterprise file transfer solution CrushFTP is being exploited by attackers in a targeted fashion, according to Crowdstrike.
According to Censys, there are currently 9,600+ publicly-exposed CrushFTP hosts, mostly in North America and Europe.
CrushFTP sent out notices about CVE-2024-4040 to customers on Friday.
Customers still running CrushFTP v9 should upgrade to version v11.1.0.
Customers using a DMZ in front of their main CrushFTP instance are only partially protected.
These attacks against CrushFTP hosts seem to be reconnaissance efforts.
News URL
https://www.helpnetsecurity.com/2024/04/23/cve-2024-4040/
Related news
- Qualcomm zero-day under targeted exploitation (CVE-2024-43047) (source)
- Ivanti fixes three CSA zero-days exploited in the wild (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381) (source)
- Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572) (source)
- Actively exploited Firefox zero-day fixed, update ASAP! (CVE-2024-9680) (source)
- Fortinet FortiManager flaw exploited in zero-day attacks (CVE-2024-47575) (source)
- Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039) (source)
- How a Windows zero-day was exploited in the wild for months (CVE-2024-43451) (source)
- Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-04-22 | CVE-2024-4040 | Code Injection vulnerability in Crushftp A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server. | 10.0 |