CrushFTP patches actively exploited zero-day
Developers behind the CrushFTP enterprise file transfer software have urged users to update to the latest version due to the discovery of a zero-day vulnerability said to have been actively exploited in the wild.
The flaw, which has yet to receive a CVE identifier, is an external control of file name or path issue that can lead to remote code execution.
“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0.,” the team said, noting that those using a DMZ (demilitarized zone) perimeter network in front of their main CrushFTP instance are protected against attacks.
While CrushFTP didn’t indicate that the flaw was exploited, in a post on Reddit, cybersecurity company CrowdStrike said it observed an exploit for the vulnerability being used in the wild in a “targeted fashion.”
According to CrowdStrike, the flaw is being exploited in attacks targeting CrushFTP servers at multiple US entities by possibly politically motivated cyberespionage group.
Latest Posts
Cyber Security Week in Review: May 3, 2024
In brief: the Dropbox breach, Chinese hackers caught manipulating China’s Great Firewall, REvil hacker sentenced, and moreю
REvil hacker sentenced to 13 years for $700M ransomware spree
In addition to his prison sentence, Vasinskyi was ordered to pay over $16 million in restitution.
Dropbox says hackers breached its Sign eSignature platform and stole sensitive data
The attackers accessed authentication tokens, MFA keys, hashed passwords, and customer info.