CrushFTP - Authentication Bypass (CVE-2025-31161)
Description
CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement.
psychologyCrowdSec Analysis
CVE-2025-31161 is a critical vulnerability affecting CrushFTP that enables authentication bypass, potentially allowing attackers to take over administrative accounts without valid credentials.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
CrowdSec network observations suggest that most exploitation of CVE-2025-31161 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2025-31161 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Exploit attempts are specifically directed towards URLs containing /webinterface/function/ along with certain user-related parameters.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-03-26 |
| Rule Released | 2025-04-07 |
| CISA KEV | 2025-04-07 |
| CrowdSec First Seen | 2025-04-25 |
| CISA Remediation Deadline | 2025-04-28 |
Remediation & Protection
External References
- https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml
- https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation
- https://www.infosecurity-magazine.com/news/crushftp-flaw-exploited-disclosure/
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-mitigate-crushftp-vulnerability
- https://projectdiscovery.io/blog/crushftp-authentication-bypass
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
- https://www.vicarius.io/vsociety/posts/cve-2025-31161-detect-crushftp-vulnerability
- https://crushftp.com/crush11wiki/Wiki.jsp?page=Update#section-Update-VulnerabilityInfo