Security News > 2024 > April > CrushFTP zero-day exploited by attackers, upgrade immediately! (CVE-2024-4040)

CrushFTP zero-day exploited by attackers, upgrade immediately! (CVE-2024-4040)
2024-04-23 09:50

A vulnerability in enterprise file transfer solution CrushFTP is being exploited by attackers in a targeted fashion, according to Crowdstrike.

According to Censys, there are currently 9,600+ publicly-exposed CrushFTP hosts, mostly in North America and Europe.

CrushFTP sent out notices about CVE-2024-4040 to customers on Friday.

Customers still running CrushFTP v9 should upgrade to version v11.1.0.

Customers using a DMZ in front of their main CrushFTP instance are only partially protected.

These attacks against CrushFTP hosts seem to be reconnaissance efforts.


News URL

https://www.helpnetsecurity.com/2024/04/23/cve-2024-4040/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2024-04-22 CVE-2024-4040 Code Injection vulnerability in Crushftp
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
network
low complexity
crushftp CWE-94
critical
10.0

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Crushftp 1 0 6 0 3 9