CVE-2024-53552
📋 TL;DR
This vulnerability in CrushFTP allows attackers to bypass password reset mechanisms, potentially leading to complete account takeover. It affects CrushFTP 10 versions before 10.8.3 and CrushFTP 11 versions before 11.2.3. Organizations using vulnerable versions of this file transfer software are at risk.
💻 Affected Systems
- CrushFTP
📦 What is this software?
Crushftp by Crushftp
Crushftp by Crushftp
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to CrushFTP servers, allowing them to steal sensitive files, modify or delete data, and potentially pivot to other systems.
Likely Case
Unauthorized access to user accounts leading to data exfiltration, privilege escalation, and disruption of file transfer operations.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring in place.
🎯 Exploit Status
While no public PoC exists, the high CVSS score and authentication bypass nature make weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CrushFTP 10.8.3 or 11.2.3
Vendor Advisory: https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
Restart Required: Yes
Instructions:
1. Download the latest version from the CrushFTP website. 2. Backup your current installation. 3. Stop the CrushFTP service. 4. Install the update. 5. Restart the CrushFTP service.
🔧 Temporary Workarounds
Disable password reset functionality
allTemporarily disable password reset features until patching can be completed
🧯 If You Can't Patch
- Implement network segmentation to isolate CrushFTP servers
- Enable multi-factor authentication for all user accounts
🔍 How to Verify
Check if Vulnerable:
Check CrushFTP version in admin interface or via system logsCheck Version:
Check CrushFTP admin panel or server logs for version informationVerify Fix Applied:
Verify version is 10.8.3 or higher for v10, or 11.2.3 or higher for v11📡 Detection & Monitoring
Log Indicators:
- Unusual password reset attempts
- Account access from unexpected locations
- Multiple failed login attempts followed by successful reset
Network Indicators:
- Unusual traffic patterns to password reset endpoints
- Authentication requests from unexpected IP ranges
SIEM Query:
source="crushftp.log" AND ("password reset" OR "account recovery") AND status="success"