CVE-2024-4040: CrushFTP VFS Sandbox Escape Vulnerability

CVE-2024-4040 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2024-04-24

A server-side template injection (SSTI) vulnerability in CrushFTP allows unauthenticated remote attackers to escape the Virtual File System (VFS) sandbox. This enables attackers to read arbitrary files from the host filesystem, bypass authentication for administrative access, and execute remote code.

Technologies: CrushFTP. Vendors: CrushFTP.

Quick answers

Is CVE-2024-4040 exploited in the wild?
Yes. CVE-2024-4040 is known to be exploited in the wild, first recorded on 24 April 2024. Treat it as urgent.
How severe is CVE-2024-4040?
Critical severity, with a CVSS score of 10, published 24 April 2024.
Which products and versions are affected?
CrushFTP CrushFTP versions before 10.7.1 and 11.1.0.
Is there a fix for CVE-2024-4040?
A patch was published on 2024-04-24T00:00:00+00:00: Fixed in versions 10.7.1 and 11.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-4040 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-4040?
Check whether you run CrushFTP. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • CrushFTP CrushFTP versions before 10.7.1 and 11.1.0

Timeline

  • 2024-04-24: disclosed
  • 2024-04-24: kev added: Added to CISA KEV catalog
  • 2024-04-24: patched: Fixed in versions 10.7.1 and 11.1.0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.