📌 Vulnerability Summary:
- CVE: CVE-2025-32102
- Affected System: CrushFTP (All versions before patched release)
- CVSS: TBD (Likely High)
- Type: Server-Side Request Forgery (SSRF)
🔬 Technical Details:
Attackers can exploit this flaw to:
- Proxy malicious requests through the server
- Access internal services (AWS metadata, databases, etc.)
- Bypass firewall restrictions
🎯 Proof of Concept:
Publicly disclosed on Full Disclosure:
PoC Link
🕵️♂️ Detection:
Shodan:
"CrushFTP HTTP Server"
ZoomEye:
app="CrushFTP"
🛠️ Mitigation:
- Immediate Patching: Apply vendor-supplied updates.
- Network Controls:
- Block external access to CrushFTP admin interfaces
- Restrict outbound requests from CrushFTP servers
- Logging: Audit all
GET/POST requests to internal endpoints.
#InfoSec #Vulnerability #NetworkSecurity
Support Crack-Vault and help us keep providing free tools. Every donation counts!
(BTC) Address: bc1qhhva8uplmkaa3kkwxnux9t3y6l6kmhnwqzktzn
