Full Report
Dive into our analysis of the CVE-2023-43117 threat in CrushFTP and the growing popularity of MFT application exploitation as a tactic for adversaries.
Analysis Summary
# Vulnerability: CrushFTP Remote Code Execution and Data Exfiltration
## CVE Details
- **CVE ID:** CVE-2023-43177 (Note: The provided text contains a typo "CVE-2023-43117", but references the official NVD record for 43177)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-77 (Improper Neutralization of Special Elements used in a Command) / CWE-94 (Code Injection)
## Affected Systems
- **Products:** CrushFTP (Multi-platform: Windows, macOS, Linux)
- **Versions:** All versions prior to v10.5.2
- **Configurations:** Typically affects internet-facing Managed File Transfer (MFT) instances.
## Vulnerability Description
CVE-2023-43177 is a critical vulnerability involving an exploitation chain that allows an unauthenticated remote attacker to access all hosted files on the victim system. Furthermore, the flaw enables arbitrary file execution, which can lead to a complete system takeover. Because CrushFTP is Java-based, the vulnerability is cross-platform.
## Exploitation
- **Status:** Exploited in the wild. Public reporting indicates that while the original researchers (Converge) delayed PoC release, sufficient technical details exist for reverse-engineering, and the vulnerability has been actively targeted by threat actors.
- **Complexity:** Low (once the exploit chain is weaponized)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Access to all hosted files and sensitive data exfiltration)
- **Integrity:** High (Arbitrary file execution and potential for full system compromise)
- **Availability:** High (Potential for ransomware deployment or system deletion)
## Remediation
### Patches
- **CrushFTP v10.5.2 or later:** Users should update immediately to the latest version. The patch was proactively released by the vendor in August 2023.
### Workarounds
- **Network Segmentation:** Place MFT solutions behind a VPN or strictly limit IP white-listing to known clients.
- **DMZ Deployment:** Ensure the application is isolated from the internal core network to prevent lateral movement.
## Detection
- **Indicators of Compromise:**
- Presence of unauthorized administrative users created in the CrushFTP user database.
- Unusual Java processes or sub-processes spawning shells (cmd.exe or /bin/sh).
- Unexplained file exfiltration patterns in network logs.
- **Detection methods and tools:**
- Monitor CrushFTP application logs for anomalous activities related to the web interface.
- Utilize EDR/SIEM tools to detect post-exploitation behavior such as the deployment of web shells or RMM tools (e.g., MeshCentral).
## References
- **Vendor Advisory:** hxxps[://]www[.]crushftp[.]com/index[.]html
- **NVD Detail:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2023-43177
- **Original Research:** hxxps[://]convergetp[.]com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/
- **Huntress Analysis:** hxxps[://]www[.]huntress[.]com/blog/mft-exploitation-and-adversary-operations