Full Report
Huntress observed in-the-wild exploitation of CVE-2025-31161, an authentication bypass vulnerability in versions of CrushFTP and further post-exploitation leveraging MeshCentral and other malware.
Analysis Summary
# Vulnerability: CrushFTP Authentication Bypass via S3 Header Processing
## CVE Details
- **CVE ID:** CVE-2025-31161 (Note: Replaced the rejected duplicate CVE-2025-2825)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication) / CWE-288 (Authentication Bypass Using an Alternate Path)
## Affected Systems
- **Products:** CrushFTP (Managed File Transfer software)
- **Versions:**
- 10.0.0 through 10.8.3
- 11.0.0 through 11.3.0
- **Configurations:** Systems publicly exposed to the internet are at high risk. The vulnerability specifically involves the processing of S3 authorization headers.
## Vulnerability Description
CVE-2025-31161 is an authentication bypass vulnerability stemming from a flaw in how CrushFTP handles S3 authorization headers. An unauthenticated remote attacker can craft specific HTTP requests to impersonate any known user—including administrative accounts. By bypassing the authentication mechanism, the attacker can gain full administrative access to the CrushFTP web interface without providing a password.
## Exploitation
- **Status:** Exploited in the wild. Huntress observed exploitation starting March 30, 2025.
- **Complexity:** Low (Requires knowledge of a valid username, such as "admin").
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to all files, data, and user credentials stored within the application).
- **Integrity:** Total (Ability to modify configurations, delete files, and create new backdoor accounts).
- **Availability:** Total (Ability to shut down services or modify critical system settings).
## Remediation
### Patches
Update immediately to the following versions or newer:
- **CrushFTP v11:** Update to version **11.3.1** or higher.
- **CrushFTP v10:** Update to version **10.8.4** or higher.
### Workarounds
- **Network Restriction:** Restrict access to the CrushFTP management interface to trusted IP addresses only.
- **Disable S3 Features:** If S3 compatibility is not required, disabling related features may reduce the attack surface, though patching remains the only verified fix.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of the **MeshCentral** agent or other unexpected Remote Monitoring and Management (RMM) tools.
- Creation of new, unauthorized administrator accounts within the CrushFTP console.
- Logs showing successful logins for administrative users from unexpected or external IP addresses.
- **Detection Methods:**
- Review CrushFTP logs for unusual S3-related HTTP requests.
- Audit file system changes for the deployment of malicious binaries or scripts post-authentication bypass.
## References
- **Vendor Advisory:** [https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update](https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update)
- **NVD Entry:** [https://nvd.nist.gov/vuln/detail/CVE-2025-31161](https://nvd.nist.gov/vuln/detail/CVE-2025-31161)
- **Huntress Analysis:** [https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation](https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation)
- **Shadowserver Statistics:** [https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/time-series/](https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/time-series/)