Critical Vulnerability Discovered in CrushFTP: VFS Sandbox Escape

What changed

CrushFTP has been found to contain a significant server-side template injection vulnerability that affects all versions prior to 10.7.1 and 11.1.0. This flaw permits attackers to escape the VFS Sandbox, enabling them to access files beyond the intended directory restrictions.

The implications of this vulnerability are serious, as it allows unauthorized users to bypass authentication mechanisms, gain administrative privileges, and execute arbitrary code on the server.

Who is affected

The vulnerability impacts all users of CrushFTP, particularly those running versions before the secure updates. Organizations utilizing this file transfer solution should be aware of the risks associated with this flaw.

Given the nature of the vulnerability, any entity relying on CrushFTP for secure file transfers may be at risk of data breaches or unauthorized access.

• CrushFTP users on versions before 10.7.1 and 11.1.0
• Organizations that depend on CrushFTP for file management
• IT departments managing CrushFTP installations
• Any third-party vendors integrating with CrushFTP

What to do

It is crucial for users of CrushFTP to immediately update their installations to the latest versions to mitigate the risks posed by this vulnerability. Regularly reviewing and applying security patches can help prevent exploitation.

Additionally, organizations should conduct security audits to assess their current configurations and ensure that proper access controls are in place.

• Upgrade to CrushFTP versions 10.7.1 or 11.1.0 or later
• Implement strict access controls and monitoring
• Conduct regular security assessments of your systems
• Stay informed about future vulnerabilities and updates from CrushFTP