CVE-2025-31161

In the AWS4-HMAC authorization method (compatible with S3), the server first verifies user existence by calling login_user_pass() without checking the password, which authenticates the session through the HMAC verification process. There is a time window (race condition) during which the session is considered valid before the server re-verifies the user. The vulnerability can be additionally stabilized – without needing to win the race condition – by sending a malformed AWS4-HMAC header containing only the username and a forward slash (/). The server then finds the user and initiates the authentication process, but does not find the required SignedHeaders entry, causing an index-out-of-bounds error that stops the code before session cleanup, leaving the session authenticated.

An attacker can authenticate as any known or guessable user, including crushadmin, leading to complete CrushFTP server compromise and takeover of all data managed by it.

CrushFTP must be immediately updated to version 10.8.4 or later (for the 10 branch) or to version 11.3.1 or later (for the 11 branch). As a temporary measure, a proxy instance in DMZ mode can be implemented, which according to the vendor's description blocks the possibility of exploiting this vulnerability.

CrushFTP version 10 before 10.8.4 and CrushFTP version 11 before 11.3.1. The vulnerability does not affect instances protected by a DMZ mode proxy.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise.