Vulnerability record · CVE-2025-31161 · published 3 April 2025
CVE-2025-31161: CrushFTP AWS4-HMAC auth bypass enables crushadmin takeover
Crushftp · Crushftp
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 contains an authentication bypass in the AWS4-HMAC (S3-compatible) authorization method of its HTTP component. A race condition, further stabilized by a mangled AWS4-HMAC header, lets the server authenticate a session before user verification completes, allowing login as any known or guessable user such as crushadmin. This matters because it leads to full administrative compromise of the file transfer server and has been exploited in the wild.
Description
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, active in-the-wild exploitation, CISA KEV listing with ransomware use, and near-maximum EPSS make this an urgent patch-first issue.
What it is
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 contains an authentication bypass in the AWS4-HMAC (S3-compatible) authorization method of its HTTP component. A race condition, further stabilized by a mangled AWS4-HMAC header, lets the server authenticate a session before user verification completes, allowing login as any known or guessable user such as crushadmin. This matters because it leads to full administrative compromise of the file transfer server and has been exploited in the wild.
Impact
An unauthenticated attacker can take over the crushadmin account and gain full control of the CrushFTP system, including access to stored files and administrative functions. CISA KEV lists known ransomware campaign use, raising the risk of data theft and encryption.
Attack surface
Reachable over the network via the HTTP(S) port using the AWS4-HMAC authorization method; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. The bypass does not apply when a DMZ proxy instance is used.
Exploitation
Exploited in the wild in March and April 2025, added to CISA KEV on 2025-04-07 with a 2025-04-28 due date, and flagged for known ransomware campaign use. EPSS is 0.99976 (99.978th percentile), and multiple references are tagged Exploit.
What to do
- Upgrade CrushFTP to 10.8.4 or later in the 10.x line, or 11.3.1 or later in the 11.x line.
- If immediate patching is not possible, follow the vendor's mitigation guidance and CISA BOD 22-01 direction, including discontinuing use if mitigations are unavailable.
- Deploy CrushFTP behind a DMZ proxy instance, which the advisory states prevents this bypass.
- Restrict network exposure of the CrushFTP HTTP(S) interface to trusted sources and monitor for unauthorized administrative logins.
- Rotate credentials and review accounts for signs of compromise, especially crushadmin, after exposure.
Detection
- Hunt for HTTP(S) requests to CrushFTP using AWS4-HMAC authorization headers with malformed or missing SignedHeaders entries.
- Alert on successful authentication or session creation for crushadmin or other privileged accounts from unexpected source IPs.
- Review CrushFTP logs for authentication sequences where login_user_pass() succeeds without a password followed by errors or index-out-of-bounds conditions.
- Monitor for post-exploitation activity on CrushFTP hosts, including new administrative actions, file access anomalies, or ransomware indicators.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-31161 to the Known Exploited Vulnerabilities catalog on 7 April 2025 as "CrushFTP Authentication Bypass Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 28 April 2025.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2025-31161 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-31161), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
