CVE-2025-54309
CRITICAL KEV NUCLEICrushFTP 10.0.0-10.8.4 and 11.0.0-11.3.3 - Unauthenticated Remote Admin Access via AS2 Validation Bypass
Title source: llmExploitation Summary
CVE-2025-54309 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added July 22, 2025. EIP tracks 9 public exploits from researchers including watchtowrlabs, 0xLittleSpidy, foregenix. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The PoC leverages a race condition by sending concurrent requests with manipulated session identifiers to extract user lists without proper authentication.
Description
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025.
Exploits (9)
This repository contains a functional Python exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The PoC leverages a race condition by sending concurrent requests with manipulated session identifiers to extract user lists without proper authentication.
This repository contains a functional Python exploit for CVE-2025-54309, targeting CrushFTP's WebInterface. The exploit leverages a race condition and improper authentication handling to perform arbitrary file reads, user enumeration, and admin user creation.
This repository contains a functional exploit for CVE-2025-54309, targeting CrushFTP. The exploit includes multiple modes (user insertion, JAR upload, command execution) and leverages hardcoded authentication cookies to bypass authentication and perform privileged actions.
This repository provides a detailed technical analysis and proof-of-concept for an authentication bypass vulnerability in CrushFTP's AS2 module, including exploitation scripts and detection tools. The research includes a thorough breakdown of the vulnerability, affected endpoints, and mitigation strategies.
This repository contains a functional Python exploit for CVE-2025-54309, a race condition vulnerability in CrushFTP that allows authentication bypass and admin user creation. The exploit leverages concurrent HTTP requests to trigger the race condition, enabling unauthorized user creation with admin privileges.
This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages a race condition to create an administrative user by sending concurrent requests with and without the AS2-TO header.
This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages improper AS2 header validation to create administrative users without authentication.
This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages improper AS2 header validation to create administrative users without authentication.
This repository contains a functional exploit for CVE-2025-54309, an authentication bypass vulnerability in CrushFTP. The exploit leverages improper AS2 header validation to create administrative users without authentication.
Nuclei Templates (1)
http.title:"crushftp" || http.favicon.hash:-1022206565
title="crushftp" || icon_hash="-1022206565"
References (6)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H