Attack Chain

1. Attacker sends a POST request to the /WebInterface/function/ endpoint of a target CrushFTP server.
2. Attacker includes a crafted 'AS2-To' header (left empty or containing specific patterns) to trigger the flawed validation logic.
3. The server executes loginCheckHeaderAuth(), which evaluates the 'AS2-To' header.
4. The logic fails to enforce authentication due to a missing delimiter (the '-_-') in the 'AS2-To' header.
5. The server process grants the request context, bypassing authentication checks.
6. The attacker invokes the 'setUserItem' command within the request body.
7. The system creates a new administrative user account.

Impact

Successful exploitation allows unauthenticated attackers to gain administrative access to the CrushFTP server, potentially leading to full system compromise, data theft, and persistence through the creation of unauthorized admin accounts.

Recommendation

1. Patch immediately: Upgrade all instances of CrushFTP to version 10.8.5 or higher (for the 10.x branch) or 11.3.4_23 or higher (for the 11.x branch).
2. Monitor web access: Audit access logs for requests to /WebInterface/function/ containing unusual 'AS2-To' headers or calls to the setUserItem function.
3. Incident Response: Review existing administrative user accounts for unauthorized additions created recently.