CVE-2024-4040: CrushFTP Server Template Injection RCE

CVE-2024-4040 is a critical server-side template injection vulnerability in CrushFTP allowing unauthenticated attackers to execute remote code, bypass authentication, and access files outside the VFS sandbox. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-4040 Overview

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Critical Impact
Exploiting this vulnerability could lead to complete server compromise, allowing attackers to execute arbitrary code remotely and potentially exfiltrate sensitive data.

Affected Products

CrushFTP versions before 10.7.1
CrushFTP versions before 11.1.0

Discovery Timeline

2024-04-22 - CVE-2024-4040 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2024-4040

Vulnerability Analysis

This vulnerability is a critical server-side template injection (SSTI) in CrushFTP that permits unauthenticated attackers to execute arbitrary code. It exists due to improper validation of user input within template expressions that are executed on the server.

Root Cause

The root cause of CVE-2024-4040 is insufficient sanitization of template expressions. This allows embedded code to be executed within templates and potentially compromises the server.

Attack Vector

Attackers can exploit the vulnerability over the network without any prior authentication, using crafted payloads within template expressions to gain access and execute code.

python

# Example exploitation code (sanitized)
malicious_payload = "{{().__class__.__bases__[0].__subclasses__()}}"
response = send_payload_to_target(malicious_payload)
print(response.text)

Detection Methods for CVE-2024-4040

Indicators of Compromise

Unusual file access patterns
Unexpected administrative access logs
Unusual process executions

Detection Strategies

Implement web application firewalls to detect and block malicious template injection patterns. Use endpoint detection and response (EDR) solutions to monitor and alert on suspicious behavioral patterns consistent with SSTI exploitation.

Monitoring Recommendations

Regularly check for unauthorized changes in configuration files and monitor server logs for signs of template injection or unauthenticated access attempts.

How to Mitigate CVE-2024-4040

Immediate Actions Required

Update CrushFTP to version 10.7.1 or 11.1.0
Implement strict input validation and sanitization measures
Restrict network access to trusted IPs

Patch Information

CrushFTP has released patches in versions 10.7.1 and 11.1.0 to address this vulnerability. Patch details and instructions are available at their official update page.

Workarounds

In environments where patching is not immediately feasible, consider isolating the vulnerable instances and using application-level firewalls to block malicious payloads.

bash

# Configuration example
iptables -A INPUT -s <trusted-ip> -p tcp --dport <service-port> -j ACCEPT
iptables -A INPUT -p tcp --dport <service-port> -j DROP