CVE-2025-54309

CVE-2025-54309 CrushFTP 인증 우회 개요 CVE-2025-54309는 CrushFTP의 인증 우회 취약점으로, AS2 헤더 조작을 통해 승인되지 않은 관리자 사용자를 생성할 수 있습니다. 기술 세부 사항 취약점 위치 파일 : crushftp/server/ServerSessionHTTP.java 메소드 : loginCheckHeaderAuth 2285행 근본 원인 : 부적절한 AS2 헤더 검증 로직 취약한 코드 else if this.headerLookup.containsKey"as2-to".toUpperCas...

CrushFTP-AS2-Bypass-Research-CVE-2025-54309

CrushFTP AS2 인증 우회 연구 ⚠️ 중요: 이 취약점은 2025년 11월 기준 CrushFTP에서 패치되었습니다. 본 연구는 교육 및 방어 목적으로만 공개됩니다. 📝 참고: 본 연구는 CVE-2025-54309와 유사한 취약점 패턴을 기반으로 합니다. 정확한 CVE 번호는 다를 수 있습니다. 이는 통제된 홈 랩 환경에서 수행된 독립적인 보안 연구입니다. 본 연구 소개 이 저장소는 AS2Applicability Statement 2 헤더 조작을 통해 완전한 관리자 액세스를 허용하는 CrushFTP 서버의 심각한 인증 우회...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

Progress MOVEit Transfer 2023.0.x / 2023.1.x < 2023.1.16 / 2024.0.x / 2024.1.x < 2024.1.7 / 2025.0.x < 2025.0.3 Uncontrolled Resource Consumption (October 2025)

The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is affected by an uncontrolled resource consumption vulnerability as referenced in Progress Community article 000291424. - Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfe...

CVE-2021-33576

An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk...

CVE-2021-33577

An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves via encryption and signing of the message can be bypassed by changing the Content-Type of the message to text/plain...

CVE-2025-10932

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

EUVD-2025-36641

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

CVE-2025-10932

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

CVE-2025-10932

CVE-2025-10932 is an Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module). The issue affects MOVEit Transfer versions 2025.0.0–before 2025.0.3, 2024.1.0–before 2024.1.7, and 2023.1.0–before 2023.1.16. The root cause is an input/AS2 request handling flaw that ca...

Progress MOVEit Transfer 资源管理错误漏洞

Progress MOVEit Transfer is a secure hosted file transfer application from Progress. A resource management error vulnerability exists in Progress MOVEit Transfer that stems from an uncontrolled resource consumption issue in the AS2 module. The following versions are affected: versions 2025.0.0...

CVE-2025-10932: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer AS2 module.This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.3, from 2024.1.0 before 2024.1.7, from 2023.1.0 before 2023.1.16...

PT-2025-44302

Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions 2023.1.0 through 2023.1.16 Progress MOVEit Transfer versions 2024.1.0 through 2024.1.7 Progress MOVEit Transfer versions 2025.0.0 through 2025.0.3 Description An uncontrolled resource consumption issue exists ...

EUVD-2021-20263

Malware in sbrugna...

EUVD-2021-20262

Malware in sbrugna...

Exploit for Unprotected Alternate Channel in Crushftp

CrushFTP AS2 Authentication Bypass – CVE-2025-54309 Aut...

CrushFTP Unprotected Alternate Channel Vulnerability

CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS...

CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...

CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...