CrushFTP: Authentication bypass and administrative account creation (CVE-2025-54309)

CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP, specifically within the loginCheckHeaderAuth() method of crushftp/server/ServerSessionHTTP.java. The vulnerability arises from improper validation logic when processing the 'AS2-To' header. Attackers can bypass authentication by sending a crafted request to the /WebInterface/function/ endpoint, enabling them to execute administrative actions, such as creating new unauthorized administrative accounts.

Attack Chain

1. Attacker sends a POST request to the /WebInterface/function/ endpoint of a target CrushFTP server.
2. Attacker includes a crafted 'AS2-To' header (left empty or containing specific patterns) to trigger the flawed validation logic.
3. The server executes loginCheckHeaderAuth(), which evaluates the 'AS2-To' header.
4. The logic fails to enforce authentication due to a missing delimiter (the '-_-') in the 'AS2-To' header.
5. The server process grants the request context, bypassing authentication checks.
6. The attacker invokes the 'setUserItem' command within the request body.
7. The system creates a new administrative user account.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to the CrushFTP server, potentially leading to full system compromise, data theft, and persistence through the creation of unauthorized admin accounts.

Recommendation

1. Patch immediately: Upgrade all instances of CrushFTP to version 10.8.5 or higher (for the 10.x branch) or 11.3.4_23 or higher (for the 11.x branch).
2. Monitor web access: Audit access logs for requests to /WebInterface/function/ containing unusual 'AS2-To' headers or calls to the setUserItem function.
3. Incident Response: Review existing administrative user accounts for unauthorized additions created recently.