Overview

CVE-2024-4040 has emerged as a significant vulnerability, highlighting the ongoing challenges in ensuring the security of digital infrastructures. This critical flaw affects CrushFTP, a powerful file transfer server known for its robust feature set and flexibility. Used by organizations worldwide, CrushFTP facilitates secure and efficient file transfers with support for various protocols, including FTP, SFTP, and HTTP/S. The vulnerability affects versions prior to 10.7.1 and 11.1.0, including older 9.x versions. However, the discovery of CVE-2024-4040, which carries a CVSS score of 9.4, exposes millions of systems to exploitation, potentially allowing malicious actors to gain unauthorized access, execute arbitrary code, and disrupt services.

‍

In this blog post, we will delve into the technical specifics of CVE-2024-4040, explore its potential impact, and provide actionable insights on how to protect your systems against this threat. Stay tuned as we unravel the intricacies of this vulnerability and equip you with the knowledge to safeguard your digital assets.

‍

Technical Details

CrushFTP comes with a web interface and the payloads for attack are delivered through HTTP headers while requesting this web interface. CrushFTP’s web interface has both authenticated and unauthenticated endpoints. Generally in web applications, before authentication, no valid session cookies are established. However, certain behaviors in CrushFTP create ambiguity between authenticated and unauthenticated states. If a web request is made to a nonexistent /WebInterface/ endpoint, a 404 response is returned along with a valid session cookie ‘CrushAuth’ for a pseudo-user named "anonymous". Although this user role lacks any privileges, some parts of the CrushFTP codebase check simply for the presence of any username. 

With this cookie, the unauthenticated APIs offered by the web interface can be accessed and hence exploited. 

The underlying issue for the vulnerability resembles very closely to Server-Side template Injection (SSTI). CrushFTP uses a templating engine to generate dynamic content and this CVE arises due to inadequate validation and sanitization of user-provided input in these templates. An attacker can create a malicious payload that, when processed by the engine, injects and executes code on the server.

‍

So CrushFTP allows execution of some function through POST requests to ‘/WebInterface/function/’ endpoint provided by the web-interface and on top of that some of these request can be made using the ‘Auth Cookie’ obtained for the pseudo-user named ‘anonymous’. 

Some of the other common commands are ‘getUserInfo’ , ‘getServerRoots’, etc. But for exploitation, a command should be used such that it replaces some of the user input in the response. 

The templating engine used by CrushFTP allows some tags like ‘<INCLUDE>’ which trigger some functions like ‘do_include_file_command’ and this specific function consumes the entire response as its argument. What this means is, to extract a file just pass the file path inside the include tag as value of path parameter in the above mentioned HTTP request:
‘<INCLUDE>(/etc/passwd)</INCLUDE>’

And the response will contain the contents of the file /etc/passwd.

Exploitation

First step towards exploitation is to identify an instance running CrushFTP with a version which falls within the range of exploitable versions. Sometimes it might get difficult to identify versions of CrushFTP, but there is a public exploit which also includes a detection script using which one can check whether the given CrushFTP instance is vulnerable to CVE-2024-4040 or not. Below is the link for that public exploit: https://github.com/jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability

‍

Follow below steps for exploitation:

‍

• Clone above mentioned github repo:

git clone https://github.com/jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability.git

‍

• Now run the detection script name ‘xdetection.py’:

python3 xdetection.py  

‍

• If the instance is found vulnerable then you can run the exploit:

python3 exploit.py -t  -r /etc/passwd

• And if it runs successfully you will get the content of file ‘/etc/passwd’:

Mitigation

• Update your CrushFTP to v11.1.0, v10.7.1, or a later version to remediate this vulnerability.
• Restrict access to the web interface to trusted IP addresses.
• Create alerts to be notified of odd file transfers or access patterns.

References

• CrushFTP File Read vulnerability (CVE-2024-4040) - vsociety
• https://github.com/jakabakos/CVE-2024-4040-CrushFTP-File-Read-vulnerability
• CrushFTP Zero-Day Exploitation Due to CVE-2024-4040 | Qualys Security Blog

‍