CVE-2025-32103
📋 TL;DR
CVE-2025-32103 is a directory traversal vulnerability in CrushFTP that allows attackers to bypass SecurityManager restrictions and read files accessible via SMB UNC share paths. This affects CrushFTP 9.x, 10.x through 10.8.4, and 11.x through 11.3.1. Attackers can exploit this through the /WebInterface/function/ URI to access sensitive files on network shares.
💻 Affected Systems
- CrushFTP
📦 What is this software?
Crushftp by Crushftp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files from SMB shares including credentials, configuration files, or proprietary data, potentially leading to lateral movement or data exfiltration.
Likely Case
Unauthorized reading of files accessible via UNC paths that the CrushFTP server can reach, potentially exposing internal network resources.
If Mitigated
Limited to reading only files that the CrushFTP service account has permission to access on SMB shares.
🎯 Exploit Status
Proof of concept details available in public disclosures. Exploitation requires crafting requests to the vulnerable URI with UNC paths.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8.5 and 11.3.2
Vendor Advisory: https://www.crushftp.com/
Restart Required: Yes
Instructions:
1. Download latest version from CrushFTP website. 2. Backup current installation. 3. Install update following vendor instructions. 4. Restart CrushFTP service.
🔧 Temporary Workarounds
Disable WebInterface
allTemporarily disable the WebInterface component if not required
Edit CrushFTP configuration to disable WebInterface or block access to /WebInterface/ path
Network Segmentation
allRestrict CrushFTP server's access to SMB shares
Configure firewall rules to block SMB (TCP 445) outbound from CrushFTP server
🧯 If You Can't Patch
- Implement strict network segmentation to isolate CrushFTP server from SMB shares
- Deploy WAF rules to block requests containing UNC paths (\\ patterns) to /WebInterface/function/
🔍 How to Verify
Check if Vulnerable:
Check if CrushFTP version is within affected ranges and WebInterface is accessibleCheck Version:
Check CrushFTP admin interface or server logs for version informationVerify Fix Applied:
Verify version is 10.8.5+ or 11.3.2+ and test that UNC path traversal attempts are blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /WebInterface/function/ containing UNC paths (\\ patterns)
- File access attempts via SMB from CrushFTP server
Network Indicators:
- Outbound SMB connections from CrushFTP server following WebInterface requests
SIEM Query:
web.url:*WebInterface/function* AND (web.url:*\\\\* OR web.url:*%5c%5c*)