CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability

CVE-2025-31161 is an authentication bypass vulnerability in CrushFTP that lets a remote unauthenticated attacker authenticate as any known or guessable user account, such as crushadmin, by abusing the HTTP authorization header. Successful abuse can lead to full compromise of the server. Because the flaw is known to be used by ransomware operators, organizations running CrushFTP should treat it as high priority and confirm all details against the vendor advisory.

CrushFTP is commonly used for secure file transfer. An authentication bypass of this type removes the primary access control, giving an attacker the same privileges as a legitimate administrative or user account and opening the door to data theft, further lateral movement, or ransomware deployment.

How it works

The weakness is classified as CWE-305 (Authentication Bypass by Primary Weakness). According to the CISA summary, the vulnerability resides in how CrushFTP processes the HTTP authorization header. An attacker who can reach the service over the network can craft a request that causes the application to accept an authentication decision for a chosen account without supplying valid credentials.

Because the attacker only needs to know or guess a valid username, accounts with predictable names (for example, crushadmin) are especially attractive. Once authenticated, the attacker inherits the privileges of that account. On a file-transfer platform this commonly means the ability to read, write, or delete files, create additional accounts, or execute administrative functions that can result in complete system takeover. Exact request formats and any version-specific conditions must be confirmed against the vendor advisory; no exploit details are provided here.

Am I affected? How to find it in your systems

CrushFTP typically runs as a dedicated file-transfer service, often exposed on HTTP/HTTPS ports and sometimes behind reverse proxies or load balancers. Inventory every host that provides managed file transfer or SFTP/FTPS/HTTPS file-sharing services and identify those running CrushFTP.

• Query configuration management databases, software inventory tools, or package managers for CrushFTP installations.
• Scan internal and external networks for services that identify themselves as CrushFTP or that present CrushFTP-specific banners or web interfaces.
• Review administrative consoles and license files for product and version strings; compare those versions against the list of affected releases published by the vendor.
• Examine web-server or application logs for unexpected successful authentications, especially for privileged accounts such as crushadmin, originating from unusual source addresses or occurring without corresponding interactive login activity.
• Look for sudden creation of new user accounts, changes to permissions, or large volumes of file downloads that coincide with anomalous authentication events.

If the software is present, treat it as potentially vulnerable until the vendor advisory confirms the exact fixed versions and any required configuration changes.

How to remediate

The primary remediation is to apply the vendor-supplied update that addresses CVE-2025-31161. Follow the installation and verification steps published by CrushFTP; after patching, restart the service and confirm the new version is running.

• Apply the update on all instances, including development, staging, and disaster-recovery copies.
• If the product is offered as a cloud service, follow applicable BOD 22-01 guidance and ensure the provider has applied the mitigation.
• After patching, rotate credentials for any accounts that may have been exposed, especially administrative ones, and review recent authentication and file-access logs for signs of prior abuse.
• Harden the remaining attack surface by enforcing strong, unique passwords or multi-factor authentication for all accounts, disabling unused user accounts, and restricting administrative interfaces to trusted networks.

If mitigations are unavailable, CISA advises discontinuing use of the product until a fix can be applied.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls that limit network reachability and increase detection capability.

• Place CrushFTP behind a network firewall or reverse proxy that permits access only from known, trusted IP ranges; block direct internet exposure if possible.
• Implement virtual patching or WAF rules that inspect and reject anomalous HTTP authorization headers; tune rules carefully to avoid breaking legitimate clients and confirm effectiveness against the vendor description of the flaw.
• Disable or tightly restrict any guest, anonymous, or default administrative accounts; rename predictable usernames where the product allows it.
• Enable detailed authentication and access logging, forward logs to a SIEM, and create alerts for successful logins of privileged accounts from unexpected sources or at unusual times.
• Segment the host so that compromise of CrushFTP does not immediately grant access to other critical systems or data stores.

These measures lower risk but do not eliminate it; schedule the permanent patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities, especially those known to be used by ransomware groups, frequently precede data theft or encryption events. Review file-transfer logs for unauthorized downloads, check for unexpected outbound connections, and examine any ransomware notes or encryption activity on the host and connected systems. If compromise is confirmed or strongly suspected, follow your incident-response plan, isolate affected systems, and preserve forensic evidence. As an additional step, you can run a free exposure scan of your email addresses against known breach data sets to determine whether credentials or personal information associated with your organization have already appeared in public dumps.