CVE-2024-4040

🗓️ 22 Apr 2024 19:21:46Reported by directcyberType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 321 Views🌐 WEB

CrushFTP VFS Sandbox Escape CVE-2024-4040

Reporter	Title	Published	Views	Family All 43
GithubExploit	Exploit for Code Injection in Crushftp	25 Apr 202419:51	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	1 May 202414:42	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	25 Apr 202405:18	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	5 Jul 202405:46	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	8 May 202608:36	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	25 Apr 202404:45	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	25 Apr 202419:51	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	25 Apr 202419:51	–	githubexploit
GithubExploit	Exploit for Code Injection in Crushftp	30 Sep 202416:18	–	githubexploit
GithubExploit	Exploit for Path Traversal in Lakernote Easyadmin	4 Jul 202514:30	–	githubexploit

NVD

Node

crushftp crushftpRange10.0.0–10.7.1

crushftp crushftpRange11.0.0–11.1.0

[
  {
    "collectionURL": "https://www.crushftp.com/download.html",
    "defaultStatus": "affected",
    "product": "CrushFTP",
    "vendor": "CrushFTP",
    "versions": [
      {
        "lessThan": "10.7.1",
        "status": "affected",
        "version": "10.0",
        "versionType": "semver"
      },
      {
        "lessThan": "11.1.0",
        "status": "affected",
        "version": "11.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
reddit	www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/
crushftp	www.crushftp.com/crush10wiki/Wiki.jsp
reddit	www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/
bleepingcomputer	www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/
crushftp	www.crushftp.com/crush11wiki/Wiki.jsp
github	www.github.com/airbus-cert/CVE-2024-4040
rapid7	www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
path	request body	WebInterface/function/	Server-side template injection via path parameter in CrushFTP API function/ enabling arbitrary file read/execution	CWE-1336, CWE-94
command	request body	WebInterface/function/	Server-side template injection via path parameter in CrushFTP API function/ enabling arbitrary file read/execution	CWE-1336, CWE-94
names	request body	WebInterface/function/	Server-side template injection via path parameter in CrushFTP API function/ enabling arbitrary file read/execution	CWE-1336, CWE-94
c2f	request body	WebInterface/function/	Server-side template injection via path parameter in CrushFTP API function/ enabling arbitrary file read/execution	CWE-1336, CWE-94

17 Jun 2026 08:00Current

8.7High risk

Vulners AI Score8.7

CVSS 3.19.8 - 10

EPSS0.99539

SSVC

vfs sandbox escape crushftp remote attack