# CVE-2024-4040: CrushFTP - Sandbox Escape

> Live exploitation tracking for CVE-2024-4040 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-4040

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** CrushFTP
- **Weaknesses:** CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine); CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** file_sharing

## Description

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

## CrowdSec analysis

[CVE-2024-4040](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-4040) is a critical vulnerability in CrushFTP that enables server-side template injection, allowing unauthenticated remote attackers to execute code, bypass authentication for admin access, and read sensitive files from the filesystem.

CrowdSec has been tracking this vulnerability and its exploits since 15th of May 2024.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2024-4040 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-4040 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Exploitation attempts typically involve requests to URLs containing `/WebInterface/`.

## Timeline

- 2024-04-22: CVE Published. CVE-2024-4040 is published to NVD.
- 2024-04-24: CISA KEV. CVE-2024-4040 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-05-01: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-05-15: Rule Released. CrowdSec releases a rule to detect CVE-2024-4040 exploitation attempts against the CrowdSec Network.
- 2024-05-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-4040 for the first time.

## References

- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/
- https://github.com/airbus-cert/CVE-2024-4040
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4040.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-4040) follows observed exploitation activity for CVE-2024-4040. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.