CVE-2025-63419
📋 TL;DR
This CVE describes a Cross-Site Scripting (XSS) vulnerability in CrushFTP's file sharing feature where malicious filenames are reflected in email bodies without proper sanitization. Attackers can inject arbitrary HTML/JavaScript that executes when victims view the email, potentially stealing credentials or session cookies. This affects CrushFTP administrators and users who receive file sharing emails.
💻 Affected Systems
- CrushFTP
📦 What is this software?
Crushftp by Crushftp
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator session cookies, gain full control of the CrushFTP server, access all files, and pivot to internal networks.
Likely Case
Attackers steal user session cookies, access shared files, and perform actions as authenticated users.
If Mitigated
Limited impact with proper email client security settings and user awareness about suspicious emails.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious email) but payload delivery is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.3.6_49 or later
Vendor Advisory: https://www.crushftp.com/
Restart Required: Yes
Instructions:
1. Download latest CrushFTP version from vendor website
2. Backup current installation
3. Stop CrushFTP service
4. Install updated version
5. Restart CrushFTP service
6. Verify version is 11.3.6_49 or higher
🔧 Temporary Workarounds
Disable file sharing emails
allTemporarily disable the file sharing email notification feature
Edit CrushFTP server settings to disable 'Send email notifications' for file shares
Implement WAF rules
allAdd XSS protection rules to web application firewall
Add rule to block HTML/JavaScript in filename parameters
🧯 If You Can't Patch
- Restrict file sharing to trusted users only
- Educate users to view emails in plain text mode
🔍 How to Verify
Check if Vulnerable:
Check if CrushFTP version is 11.3.6_48 or earlier and file sharing feature is enabledCheck Version:
Check CrushFTP admin interface or server logs for version informationVerify Fix Applied:
Verify version is 11.3.6_49 or later and test file sharing with malicious filename payloads📡 Detection & Monitoring
Log Indicators:
- Unusual filenames containing script tags in file sharing logs
- Multiple failed file share attempts with special characters
Network Indicators:
- HTTP requests with script tags in filename parameters
- Unusual email generation patterns
SIEM Query:
source="crushftp.log" AND (filename CONTAINS "<script>" OR filename CONTAINS "javascript:")