CVE-2024-4040

The error results from improper server-side template handling (CWE-1336, CWE-94), allowing an attacker to inject malicious code into the template engine without requiring any credentials. Exploitation of the vulnerability enables bypassing the virtual file system sandbox (VFS Sandbox) and accessing operating system resources. Consequently, an attacker can escalate the attack to complete server takeover by executing arbitrary system commands (RCE).

An attacker can obtain unauthorized administrative access, read arbitrary files from the file system outside the VFS Sandbox, and execute remote code on the server (RCE), leading to complete system takeover.

CrushFTP must be immediately updated to version 10.7.1 or newer (in the 10.x branch) or to version 11.1.0 or newer (in the 11.x branch). Update instructions are available in the official manufacturer's wiki at the addresses provided in the references.

CrushFTP in all versions before 10.7.1 and before 11.1.0 on all platforms

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).