Listen to this Post
How CVE-2025-54309 Works
CrushFTP versions 10 (before 10.8.5) and 11 (before 11.3.4_23) contain a critical vulnerability in their AS2 validation mechanism when the DMZ proxy feature is disabled. The flaw improperly handles AS2 message authentication during HTTPS communications, allowing attackers to bypass security checks. By crafting malicious AS2 requests, an unauthenticated remote attacker can exploit this weakness to gain administrative privileges on the target system. The vulnerability is actively exploited in the wild since July 2025, with attackers sending specially crafted HTTPS requests that manipulate the AS2 validation process to escalate privileges.
DailyCVE Form
Platform: CrushFTP
Version: <10.8.5, <11.3.4_23
Vulnerability: AS2 validation bypass
Severity: Critical
Date: 2025-07-18
Prediction: Patch by 2025-08-15
What Undercode Say
$ curl -X POST https://target/crushftp/ -H "AS2-Validation: malformed" $ nmap -p 443 --script crushftp-cve-2025-54309 <target>
How Exploit
- Craft malicious AS2 headers
- Send via HTTPS to CrushFTP
- Bypass authentication checks
- Gain admin access
Protection from this CVE
- Upgrade to 10.8.5+
- Upgrade to 11.3.4_23+
- Disable AS2 if unused
- Enable DMZ proxy
Impact
- Full system compromise
- Data theft possible
- RCE potential
- Active exploitation
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
