{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/crushftp-10.x--10.8.5-11.x--11.3.4_23/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9,"id":"CVE-2025-54309"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CrushFTP (10.x \u003c 10.8.5, 11.x \u003c 11.3.4_23)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","web-exploitation","crushftp"],"_cs_type":"advisory","_cs_vendors":["CrushFTP"],"content_html":"\u003cp\u003eCVE-2025-54309 is an authentication bypass vulnerability in CrushFTP, specifically within the \u003ccode\u003eloginCheckHeaderAuth()\u003c/code\u003e method of \u003ccode\u003ecrushftp/server/ServerSessionHTTP.java\u003c/code\u003e. The vulnerability arises from improper validation logic when processing the 'AS2-To' header. Attackers can bypass authentication by sending a crafted request to the \u003ccode\u003e/WebInterface/function/\u003c/code\u003e endpoint, enabling them to execute administrative actions, such as creating new unauthorized administrative accounts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a POST request to the \u003ccode\u003e/WebInterface/function/\u003c/code\u003e endpoint of a target CrushFTP server.\u003c/li\u003e\n\u003cli\u003eAttacker includes a crafted 'AS2-To' header (left empty or containing specific patterns) to trigger the flawed validation logic.\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003eloginCheckHeaderAuth()\u003c/code\u003e, which evaluates the 'AS2-To' header.\u003c/li\u003e\n\u003cli\u003eThe logic fails to enforce authentication due to a missing delimiter (the '-_-') in the 'AS2-To' header.\u003c/li\u003e\n\u003cli\u003eThe server process grants the request context, bypassing authentication checks.\u003c/li\u003e\n\u003cli\u003eThe attacker invokes the 'setUserItem' command within the request body.\u003c/li\u003e\n\u003cli\u003eThe system creates a new administrative user account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain administrative access to the CrushFTP server, potentially leading to full system compromise, data theft, and persistence through the creation of unauthorized admin accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately: Upgrade all instances of CrushFTP to version 10.8.5 or higher (for the 10.x branch) or 11.3.4_23 or higher (for the 11.x branch).\u003c/li\u003e\n\u003cli\u003eMonitor web access: Audit access logs for requests to \u003ccode\u003e/WebInterface/function/\u003c/code\u003e containing unusual 'AS2-To' headers or calls to the \u003ccode\u003esetUserItem\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eIncident Response: Review existing administrative user accounts for unauthorized additions created recently.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-24T00:02:44Z","date_published":"2026-10-24T00:02:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-crushftp-auth-bypass/","summary":"CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP allowing unauthenticated administrative account creation via manipulation of the AS2-To header.","title":"CrushFTP: Authentication bypass and administrative account creation (CVE-2025-54309)","url":"https://feed.craftedsignal.io/briefs/2026-10-crushftp-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CrushFTP (10.x \u003c 10.8.5, 11.x \u003c 11.3.4_23)","version":"https://jsonfeed.org/version/1.1"}