Authentication Bypass in CrushFTP (CVE‑2025‑31161) Allows Remote Unauthenticated Access
What It Is — CrushFTP server contains an authentication‑bypass flaw in the handling of the HTTP Authorization header. An unauthenticated remote actor can craft a header that the product treats as valid, granting access to any known or guessable account (e.g., crushadmin).
Exploitability — The vulnerability is exploitable over the network without prior credentials; proof‑of‑concept code is publicly available. The NVD assigns a CVSS v3.1 base score of 9.8 (Critical).
Affected Products — All versions of CrushFTP released before the vendor‑issued patch (see CISA KEV advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification of authentication controls and real‑time evidence that only authorized identities can access privileged functions.
- Highlights gaps in audit‑ready logging of successful and failed login attempts, a key signal for regulators and enterprise auditors.
- Forces organizations to prove defensible access‑control policies (e.g., MFA, least‑privilege) across third‑party file‑transfer services used in supply‑chain workflows.
Recommended Actions
- Apply the vendor’s security patch immediately; verify the version number after upgrade.
- Rotate all privileged credentials (e.g.,
crushadmin) and enforce multi‑factor authentication where possible. - Enable and centralize authentication logs; integrate them with a SIEM for continuous monitoring.
- Conduct a rapid access‑control review of any internal applications that rely on CrushFTP for data movement.
Source: CISA KEV – CVE‑2025‑31161