CVE-2025-32102: CrushFTP SSRF Vulnerability

CVE-2025-32102 Overview

CVE-2025-32102 is a Server-Side Request Forgery (SSRF) vulnerability affecting CrushFTP file transfer server software. The vulnerability exists in versions 9.x, 10.x through 10.8.4, and 11.x through 11.3.1. Attackers with low-level privileges can exploit this flaw by manipulating the host and port parameters in a command=telnetSocket request sent to the /WebInterface/function/ URI endpoint, allowing them to forge server-side requests to arbitrary internal or external destinations.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to probe internal network infrastructure, access internal services, or potentially pivot to other systems within the network perimeter that would otherwise be inaccessible from external networks.

Affected Products

• CrushFTP 9.x (all versions)
• CrushFTP 10.x through 10.8.4
• CrushFTP 11.x through 11.3.1

Discovery Timeline

• 2025-04-15 - CVE-2025-32102 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-32102

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) allows authenticated attackers to make the CrushFTP server initiate network connections to arbitrary hosts. The vulnerability resides in the telnet socket functionality exposed through the web interface. When a user sends a crafted request to the /WebInterface/function/ endpoint with the command=telnetSocket parameter, the server processes user-supplied host and port values without adequate validation.

The attack requires network access and low-level authentication (authenticated user account), but no user interaction is needed. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope. While the vulnerability does not directly compromise confidentiality or availability of the CrushFTP system itself, it allows for integrity impacts through the ability to forge requests to internal services.

Root Cause

The root cause stems from insufficient input validation and sanitization of the host and port parameters in the telnet socket command handler. The CrushFTP application fails to properly restrict which hosts and ports can be specified in these parameters, allowing attackers to specify arbitrary internal or external network destinations. This represents a classic SSRF pattern where user-controlled input directly influences server-side network operations without adequate security controls or allow-list restrictions.

Attack Vector

The attack is network-based and requires an authenticated session with the CrushFTP server. An attacker with valid credentials (even low-privilege accounts) can craft malicious HTTP requests targeting the /WebInterface/function/ endpoint. By manipulating the host and port parameters within a command=telnetSocket request, the attacker can direct the CrushFTP server to establish connections to:

• Internal network services not exposed to the internet
• Cloud metadata endpoints (e.g., 169.254.169.254)
• Internal databases, APIs, or administrative interfaces
• Other internal hosts for network reconnaissance

The server acts as a proxy for these requests, potentially bypassing firewall rules and network segmentation that would otherwise protect internal resources from external access.

Detection Methods for CVE-2025-32102

Indicators of Compromise

• Unusual outbound connections from the CrushFTP server to internal IP ranges or cloud metadata endpoints
• HTTP requests to /WebInterface/function/ containing command=telnetSocket with suspicious host or port parameters
• Connections to RFC 1918 private address ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) originating from the CrushFTP service
• Increased connection attempts to internal services from the CrushFTP server process

Detection Strategies

• Monitor CrushFTP web server logs for requests containing command=telnetSocket with unusual host parameters
• Implement network monitoring to detect anomalous outbound connections from the CrushFTP server
• Deploy web application firewall (WAF) rules to inspect and block requests with suspicious SSRF patterns to the vulnerable endpoint
• Use SentinelOne Singularity to detect and alert on unusual network behavior from the CrushFTP process

Monitoring Recommendations

• Enable verbose logging for the CrushFTP web interface and regularly review logs for exploitation attempts
• Configure network segmentation monitoring to alert on unexpected cross-segment communications from the CrushFTP server
• Implement egress filtering and monitor for connections to internal infrastructure from web-facing services
• Set up alerts for requests to the /WebInterface/function/ endpoint with telnet-related commands

How to Mitigate CVE-2025-32102

Immediate Actions Required

• Upgrade CrushFTP to the latest patched version beyond 10.8.4 (for 10.x branch) or beyond 11.3.1 (for 11.x branch)
• Restrict network access to the CrushFTP administrative interface to trusted IP addresses only
• Implement strict firewall rules limiting outbound connections from the CrushFTP server
• Review user accounts and remove unnecessary or unused credentials to limit potential attack surface

Patch Information

CrushFTP has addressed this vulnerability in versions released after 10.8.4 and 11.3.1. Organizations should upgrade to the latest available version from the CrushFTP Official Website. For detailed technical information about this vulnerability, refer to the Full Disclosure Mailing List or Packet Storm security advisory.

Workarounds

• If immediate patching is not possible, restrict access to the /WebInterface/function/ endpoint through web server configuration or reverse proxy rules
• Implement network-level egress filtering to prevent the CrushFTP server from initiating connections to internal network ranges
• Deploy a web application firewall (WAF) with rules to block requests containing command=telnetSocket with untrusted host values
• Consider temporarily disabling the telnet socket functionality if not required for business operations

# Example: Restrict outbound connections from CrushFTP server using iptables
# Block common internal IP ranges to mitigate SSRF exploitation
iptables -A OUTPUT -m owner --uid-owner crushftp -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner crushftp -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner crushftp -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner crushftp -d 169.254.169.254 -j DROP