CVE-2025-63420
📋 TL;DR
CVE-2025-63420 is a stored HTML injection vulnerability in CrushFTP11's admin panel that allows attackers to inject malicious HTML into the 'Who Created Folder' report. This enables persistent HTML execution when administrators view the report, potentially leading to session hijacking or phishing attacks. Only CrushFTP11 installations with admin panel access are affected.
💻 Affected Systems
- CrushFTP11
📦 What is this software?
Crushftp by Crushftp
⚠️ Risk & Real-World Impact
Worst Case
Administrator session hijacking leading to full system compromise, data theft, or ransomware deployment through social engineering attacks.
Likely Case
Session hijacking or credential theft via phishing pages displayed to administrators viewing the malicious report.
If Mitigated
Limited impact with proper input validation and output encoding preventing HTML execution.
🎯 Exploit Status
Exploitation requires authenticated access to the admin panel. Public proof-of-concept demonstrates HTML injection.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.3.7_57
Vendor Advisory: https://www.crushftp.com/
Restart Required: Yes
Instructions:
1. Download CrushFTP11 version 11.3.7_57 or later from the official vendor site. 2. Backup current configuration and data. 3. Stop the CrushFTP service. 4. Install the updated version. 5. Restart the CrushFTP service.
🔧 Temporary Workarounds
Disable Reports Feature
allTemporarily disable the Reports feature in the admin panel to prevent exploitation.
Navigate to Admin Panel > Settings > Reports and disable 'Who Created Folder' reporting
Restrict Admin Panel Access
allLimit access to the admin panel to trusted IP addresses only.
Configure firewall rules to restrict access to CrushFTP admin panel port (default 8080)
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user inputs in the Reports feature.
- Monitor admin panel access logs for suspicious activity and implement multi-factor authentication for admin accounts.
🔍 How to Verify
Check if Vulnerable:
Check CrushFTP version in admin panel or via command line: java -jar CrushFTP.jar --versionCheck Version:
java -jar CrushFTP.jar --versionVerify Fix Applied:
Verify version is 11.3.7_57 or later and test the 'Who Created Folder' report for HTML injection.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML content in report entries
- Multiple failed login attempts to admin panel
- Suspicious admin session activity
Network Indicators:
- Unusual traffic patterns to admin panel port
- Requests containing HTML injection payloads
SIEM Query:
source="crushftp.log" AND ("Who Created Folder" OR "report" AND "<script>" OR "javascript:")