CrushFTP CVE-2025-54309: Critical AS2 Validation Flaw Enables Admin Takeover via HTTPS
Introduction
In July 2025, attackers were observed exploiting a critical flaw in CrushFTP, a popular enterprise file transfer server, to gain administrative access over HTTPS. The vulnerability, tracked as CVE-2025-54309, affects organizations that use CrushFTP for secure B2B data exchange, particularly those that use the AS2 protocol. Remote, unauthenticated attackers can take full control of vulnerable servers, exfiltrate sensitive data, and move laterally within enterprise networks.
CrushFTP is a cross-platform managed file transfer (MFT) server that supports FTP, SFTP, HTTP/S, WebDAV, and AS2. It is widely deployed in the finance, healthcare, and logistics sectors, with thousands of enterprise installations worldwide. Its flexibility and protocol support put it at the center of secure data workflows, which also makes it a high-value target for attackers.
Technical Information
Vulnerability Mechanism
CVE-2025-54309 is triggered when the DMZ proxy feature in CrushFTP is not enabled. The flaw is improper validation of AS2 (Applicability Statement 2) messages. AS2 is a protocol for secure, signed data exchange over HTTPS.
The vulnerable code path does not enforce cryptographic checks on AS2 Message Integrity Check (MIC) values, and it does not sufficiently validate or sanitize multipart message content. Attackers can craft malicious AS2 messages with manipulated headers (such as AS2-To) and payloads that bypass authentication and integrity controls. From there, they can interact with CrushFTP's admin API endpoints (e.g., /WebInterface/function/) and escalate privileges to full administrative access.
Vulnerable Code Pattern (Illustrative)
// Example: Flawed AS2 MIC validation logic public boolean validateMIC(AS2Message message) { String receivedMIC = message.getMIC(); // No comparison to computedMIC return true; // Vulnerable: always returns true }
Exploitation Flow
- The attacker creates a multipart AS2 message with a forged MIC and spoofed headers.
- The message is delivered to the CrushFTP server over HTTPS.
- Because the checks are insufficient, the server accepts the message and processes it as if it came from a trusted partner.
- Through the admin API endpoints, the attacker creates or accesses privileged accounts.
Note: The vulnerability is present only when the DMZ proxy feature is not in use. Enabling the DMZ proxy mitigates the attack vector by isolating AS2 processing.
Patch Information
CrushFTP has fixed CVE-2025-54309 in these versions:
- 10.8.5 and later
- 11.3.4_23 and later
Patch steps:
- Download the latest version from the official CrushFTP site.
- Follow the upgrade instructions so that every component is updated.
If you cannot patch immediately, confirm that the DMZ proxy feature is enabled.
Official advisory:
Affected Systems and Versions
Vulnerable versions:
- CrushFTP 10: all versions before 10.8.5
- CrushFTP 11: all versions before 11.3.4_23
These versions are vulnerable only when the DMZ proxy feature is not enabled. A deployment that runs one of them without the DMZ proxy is at critical risk.
Vendor Security History
CrushFTP has had several significant vulnerabilities in recent years, including:
- CVE-2025-31161, an authentication bypass (patched quickly in March 2025)
- CVE-2024-4040 and CVE-2023-43177, other protocol-related flaws
The vendor usually patches critical vulnerabilities within days of disclosure. The repeated authentication and protocol validation bugs, though, suggest that it still struggles to implement protocols securely. Organizations running CrushFTP should apply updates promptly and consider additional hardening.
References
- NVD Entry for CVE-2025-54309
- Official CrushFTP Advisory: July 2025 Compromise
- CrushFTP AS2 Documentation
- CrushFTP DMZ Proxy Guide
- CrushFTP Download Page
- CVE-2025-31161 Analysis
Source: This report was created using AI
If you have feedback or suggestions for improvement, email us at [email protected]
