CrushFTP 10.x < 10.8.5 / 11.x < 11.3.4_23 Privilege Escalation (CVE-2025-54309)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242340);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/22");

  script_cve_id("CVE-2025-54309");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/08/12");

  script_name(english:"CrushFTP 10.x < 10.8.5 / 11.x < 11.3.4_23 Privilege Escalation (CVE-2025-54309)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The CrushFTP application installed on the remote host is missing a vendor-supplied patch. It is, therefore, affected
by a vulnerability. CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used,
mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the
wild in July 2025.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025#section-CompromiseJuly2025-CVE202554309
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20b697cf");
  # https://www.bleepingcomputer.com/news/security/crushftp-zero-day-exploited-in-attacks-to-gain-admin-access-on-servers/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dd44f70f");
  script_set_attribute(attribute:"solution", value:
"Update to version 10.8.5, 11.3.4_23 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-54309");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:crushftp:crushftp");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"FTP");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("crushftp_server_win_installed.nbin", "crushftp_server_nix_installed.nbin");
  script_require_keys("installed_sw/CrushFTP");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'CrushFTP');

#11.3.4 >= build 23 is not affected
if (
    (!(empty_or_null(app_info.Build))) &&
    (ver_compare(ver:app_info.version, fix:'11.3.4', strict:false) == 0) &&
    (ver_compare(ver:app_info.Build, fix:'23', strict:false) >= 0)
   )
{
  vcf::audit(app_info);
}

var constraints = [
  { 'min_version' : '10.0', 'fixed_version' : '10.8.5' },
  { 'min_version' : '11.0', 'fixed_version' : '11.3.5', 'fixed_display' : '11.3.4_23' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);