CVE-2025-31161
About
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
Rainforest analyst review
This is an authentication bypass in CrushFTP's HTTP(S) component, in the AWS4-HMAC (S3-compatible) authorization path. The server first checks whether a username exists by calling its login routine with no password required, which authenticates the session through the HMAC flow before a later verification step. An attacker sends a mangled AWS4-HMAC header supplying only a username followed by a slash; the server finds the user and completes the anypass authentication, then fails to locate the expected SignedHeaders and hits an index-out-of-bounds error that stops execution before session cleanup. The net effect is trivial, reliable authentication as any known or guessable account, including crushadmin, yielding full administrative takeover.
CrushFTP is a managed file-transfer server, the kind of internet-facing choke point that holds the sensitive files organizations exchange, and this was exploited in the wild in March and April 2025, so exposed instances should be assumed targeted. Upgrade to 10.8.4 or 11.3.1 or later at once. Fronting the server with a DMZ proxy instance mitigates it, and afterward audit administrator accounts, review transfer and access logs, and rotate credentials.
References
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
- https://projectdiscovery.io/blog/crushftp-authentication-bypass
- https://www.darkreading.com/vulnerabilities-threats/disclosure-drama-clouds-crushftp-vulnerability-exploitation
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31161
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2025-31161?
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server.
How severe is CVE-2025-31161?
CVE-2025-31161 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2025-31161 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2025-31161?
Public advisories list the following as affected: crushftp. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2025-31161?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.