CVE-2024-4040 PoC — Unauthenticated arbitrary file read and remote code execution in CrushFTP

Description

Exploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms

Readme

# CVE-2024-4040-CrushFTP-server

CrushFTP is a proprietary multi-protocol, multi-platform file transfer server.

**CVE-2024-4040** - A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read any files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server. 

Affected versions: CrushFTP versions before 10.7.1 and 11.1.0

**Usage:** python3 exploit.py -u -p

**Usage example:** python3 exploit.py -u http://127.0.0.1 -p 8080

**Disclaimer: This exploit is to be used only for educational and authorized testing purposes. Illegal/unauthorized use of this exploit is prohibited.**

**References:**
https://nvd.nist.gov/vuln/detail/CVE-2024-4040
https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/
https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/

File Snapshot

Remarks