CVE-2024-4040
Published 2024-04-22 · Updated 2026-06-17 · Source 430a6cef-dc26-47e3-9fa8-52fb7f19644e
Summary
CVE-2024-4040 is a critical-severity (CVSS 9.8) vulnerability in CrushFTP CrushFTP. CISA added it to the Known Exploited Vulnerabilities catalog on April 24, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 1, 2024. CISA does not currently list it as used in ransomware campaigns. CrushFTP has 3 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.
All 3 known-exploited CrushFTP vulnerabilities →Description
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: CrushFTP — CrushFTP
Name: CrushFTP VFS Sandbox Escape Vulnerability
Date added: 2024-04-24 · Due: 2024-05-01
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
References
- https://github.com/airbus-cert/CVE-2024-4040
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
- https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/
- https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/
- https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/
- https://github.com/airbus-cert/CVE-2024-4040