Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: CrushFTP suffers from an **AS2 validation flaw** allowing **Authentication Bypass**.
💥 **Consequences**: Remote attackers can bypass login checks to gain **Full Admin Access** without credentials.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **CWE-420** (Acceptance of Extraneous Untrusted Data).
🔍 **Flaw**: Logic error in `ServerSessionHTTP.java` (`loginCheckHeaderAuth`). The system fails to properly validate the `AS2-To` header.…

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected Products**: **CrushFTP** (File Transfer Server).…

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

👑 **Attacker Capabilities**:
• **Privileges**: Gains **Administrator Rights** instantly.
• **Data**: Full read/write access to all files.…

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

📉 **Exploitation Threshold**: **LOW**.
🔑 **Auth**: **None** required (Unauthenticated).
⚙️ **Config**: Requires standard HTTPS access.…

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

💣 **Public Exploits**: **YES**.
🔥 **Wild Exploitation**: **Confirmed** (Exploited in the wild since July 2025).…

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check Methods**:
1. **Scan**: Use Nuclei template `code/cves/2025/CVE-2025-54309.yaml`.
2. **Verify**: Send HTTP request with empty/invalid `AS2-To` header.
3.…

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

🛠️ **Official Fix**: **YES**.
✅ **Patch Versions**:
• Upgrade to **CrushFTP 10.8.5** or later.
• Upgrade to **CrushFTP 11.3.4_23** or later.…

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch Workaround**:
1. **Block Access**: Restrict HTTP/HTTPS access to trusted IPs only (WAF/ACL).
2. **Disable AS2**: If not used, disable AS2 features entirely.
3.…

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔴 **Priority**: **CRITICAL (Immediate Action)**.
⏱️ **Urgency**: **High**.
📉 **Reason**: CVSS 9.8, Unauthenticated, Wild Exploitation Active.
🚀 **Action**: Patch immediately.…

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-54309 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring