Over 1,400 CrushFTP Instances Vulnerable to Exploited Zero-Day

More than 1,400 CrushFTP servers remain vulnerable to an actively exploited zero-day for which PoC has been published.

More than 1,400 CrushFTP managed file transfer software instances remain vulnerable to a recently disclosed zero-day, according to data from the Shadowserver Foundation shows.

Tracked as CVE-2024-4040 (CVSS score of 9.8), the critical-severity bug is described as a server-side template injection that allows remote attackers to escape the virtual file system (VFS) sandbox, gain administrative privileges, and execute arbitrary code.

CrushFTP disclosed the flaw on April 19, warning customers of in-the-wild exploitation and urging them to upgrade to version 10.71 or 11.1.0, which address it. CrushFTP versions 9, 10, and 11 are affected.

On April 22, one day before Simon Garrelou of Airbus CERT, who was credited for discovering CVE-2024-4040, published proof-of-concept (PoC) code targeting the bug, CrushFTP updated its advisory to warn that using a ...