CrushFTP-AS2-Bypass-Research-CVE-2025-54309

Research on CrushFTP AS2 authentication bypass allowing unauthenticated admin access. Includes PoC scripts, detection rules, and technical analysis for educational and defensive purposes.

🔍 Vulnerability Details

Technical Summary

CrushFTP's web interface incorrectly trusts AS2 protocol headers without proper validation. The server assumes AS2 requests are pre-authenticated and bypasses normal authentication procedures.

Key Details

• Product: CrushFTP Server
• Component: AS2 Authentication Module
• Estimated CVSS: 9.8 (Critical)
• Attack Vector: HTTP Header Manipulation
• Complexity: LOW - Single HTTP request
• Authentication: NONE required
• Impact: Complete system compromise
• Related CVE: Similar to CVE-2025-54309

Tested Versions

Vulnerable CrushFTP Versions (Confirmed in Lab):

• CrushFTP 10.x (tested on 10.5.x branch)
• CrushFTP 11.x (tested on 11.1.x branch)

Patched Versions:

• CrushFTP 10.7.0+ (patched November 2025)
• CrushFTP 11.2.0+ (patched November 2025)

Lab Environment:

• Operating System: Linux (Ubuntu 22.04 LTS)
• Test Infrastructure: Isolated home lab network
• No production systems were tested

Attack Vector

Example (Lab Environment):

Note: Only use on systems you own or have explicit permission to test.

Critical Discovery

During exploitation, we discovered a mathematical relationship in session cookie generation that makes exploitation 100% reliable:

� What You'll Find Here

🔧 Exploitation Tools

• Complete PoC scripts with session management
• Targeted testing for high-value endpoints
• Adaptive exploitation with multiple strategies

🔍 Detection & Defense

• IDS/IPS rules (Snort & Suricata)
• Log analysis scripts for IOC detection
• Network signatures for monitoring

📖 Documentation

• Technical analysis - Complete vulnerability breakdown
• Exploitation methodology - Step-by-step attack chain
• Session management - Mathematical pattern discovered
• JavaScript analysis - Client-side code reverse engineering

📊 Impact Assessment

Post-Exploitation Capabilities

✅ Complete server and user enumeration
✅ User account creation and modification
✅ File system access and browsing
✅ Command execution via telnet interface
✅ Job scheduling with system privileges
✅ PGP key and certificate access
✅ Administrative configuration modification

🛡️ Mitigation & Remediation

Immediate Actions (CRITICAL)

1. Patch CrushFTP to the latest version immediately
2. Disable AS2 functionality if not required
3. Implement WAF rules blocking AS2 headers from untrusted sources
4. Reset all administrative credentials on CrushFTP servers
5. Enable MFA for administrative panels

Detection Implementation

See detection/ directory for:

• IDS/IPS signatures (Snort, Suricata)
• Log analysis queries
• Network traffic signatures
• Behavioral anomaly detection rules

Long-term Security Measures

• Implement multi-factor authentication
• Network segmentation for admin interfaces
• Regular security assessments
• Principle of least privilege enforcement

📈 Detection & Forensics

HTTP Traffic Signatures

Network Indicators

• Large HTTP responses (19KB+) from admin endpoints without authentication
• POST requests to /WebInterface/function/ with AS2 headers
• Administrative panel access without prior login
• Unusual traffic patterns to CrushFTP servers

Log Analysis

📚 Repository Contents

Quick Start

1. Read the docs:

   • Start with this README for overview
   • See TECHNICAL_ANALYSIS.md for deep technical details

2. Test in your lab:

   root@kitploit:~

   # Make sure you own the target system!
   ./exploits/enhanced_session_exploit.sh 10.0.100.50
   

3. Deploy detection:

   • Copy IDS rules to your Snort/Suricata
   • Run log analysis script on your web server logs

🔬 Research Findings

Key Technical Achievements

✅ Complete AS2 authentication bypass discovered and documented
✅ Critical session cookie generation requirement identified and solved
✅ Mathematical relationship in session management reverse-engineered
✅ Two-phase exploitation methodology developed
✅ 100% reliable exploitation pattern established
✅ Multiple RCE vectors identified and analyzed
✅ Complete JavaScript source code analysis performed

Affected CrushFTP Endpoints

• /WebInterface/admin/index.html - Main admin panel
• /WebInterface/admin/telnet.html - Telnet interface
• /WebInterface/Jobs/index.html - Job management
• /WebInterface/UserManager/index.html - User management
• /WebInterface/PGP/index.html - PGP key management
• /WebInterface/function/ - Administrative function processor

🔗 References

• CrushFTP Official Website
• CVSS 3.1 Calculator
• CWE-287: Improper Authentication
• OWASP Authentication Cheat Sheet

👤 Author

Author: SmileyFace101
GitHub: @SmileyFace101
Research Period: March - July 2025 (Home Lab)
Public Disclosure: December 6, 2025

⚖️ Legal & Ethical Notice

This research is for EDUCATIONAL and DEFENSIVE purposes ONLY.

✅ Authorized Use:

• Security research and education
• Defending your own systems
• Authorized penetration testing
• Understanding attack patterns

❌ Prohibited:

• Unauthorized system access
• Testing systems without permission
• Malicious use
• Any illegal activity

By using this research, you agree to:

1. Use it only on systems you own or have written permission to test
2. Comply with all applicable laws and regulations
3. Practice responsible disclosure
4. Assume all responsibility for your actions

Disclaimer: The author is not responsible for misuse. Unauthorized computer access is illegal.

📄 License

MIT License - See LICENSE file for details.

Last Updated: December 6, 2025
Risk Assessment: CRITICAL - Immediate patching and mitigation required

Last Updated: December 6, 2025
Author: SmileyFace101
Research Conducted: March - July 2025 in authorized lab environment