Update April 22, 16:31 EDT: This CrushFTP VFS sandbox escape vulnerability is now tracked as CVE-2024-4040. CrushFTP warned customers today in a private memo of an actively exploited zero-day vulnerability fixed in new versions released today, urging them to patch their servers immediately. As the company also explains in a public security advisory published on Friday, this zero-day bug enables unauthenticated attackers to escape the user's virtual file system (VFS) and download system files. However, those using a DMZ (demilitarized zone) perimeter network in front of their main CrushFTP instance are protected against attacks. "Please take immediate action to patch ASAP. A vulnerability was reported today (April 19th, 2024), and we patched it immediately. [..] This vulnerability exists in the wild," the company warned customers via email. "The bottom line of this vulnerability is that any unauthenticated or authenticated user via the WebInterface could retrieve system files that are not part of their VFS. This could lead to escalation as they learn more, etc." The company also warned customers with servers still running CrushFTP v9 to immediately upgrade to v11 or update their instance via the dashboard. "There is a simple rollback in case you have an issue or regression with some functionality. Update immediately," CrushFTP warned. The security flaw was reported by Simon Garrelou of Airbus CERT and is now fixed in CrushFTP versions 10.7.1 and 11.1.0. According to Shodan, a...
CrushFTP warns users to patch exploited zero-day “immediately”
BleepingComputer
·Published Apr 19, 2024
·Updated
Affected Software
1 affected component
CrushFTP VFS sandbox escape vulnerability=10.7.1, =11.1.0
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a zero-day vulnerability in CrushFTP that has been actively exploited, prompting the company to urge users to patch immediately.
2
What security implications are discussed in the article?
The implication is that the VFS sandbox escape vulnerability could allow attackers to escape the sandbox environment and potentially compromise the system.
3
What products or software are affected by this vulnerability?
The vulnerability affects CrushFTP versions up to and including 10.7.1 and 11.1.0.
4
What is the designated CVE number for the vulnerability?
The vulnerability is tracked as CVE-2024-4040.
5
What actions are users advised to take in response to this vulnerability?
Users are advised to update to the latest versions of CrushFTP to patch the vulnerability immediately.