CrushFTP patches actively exploited zero-day
Developers behind the CrushFTP enterprise file transfer software have urged users to update to the latest version due to the discovery of a zero-day vulnerability said to have been actively exploited in the wild.
The flaw, which has yet to receive a CVE identifier, is an external control of file name or path issue that can lead to remote code execution.
“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files. This has been patched in v11.1.0.,” the team said, noting that those using a DMZ (demilitarized zone) perimeter network in front of their main CrushFTP instance are protected against attacks.
While CrushFTP didn’t indicate that the flaw was exploited, in a post on Reddit, cybersecurity company CrowdStrike said it observed an exploit for the vulnerability being used in the wild in a “targeted fashion.”
According to CrowdStrike, the flaw is being exploited in attacks targeting CrushFTP servers at multiple US entities by possibly politically motivated cyberespionage group.
Latest Posts
Cyber Security Week in Review: July 26, 2024
In brief: A North Korean hacker indicted for ransomware attacks, French police dismantle the PlugX botnet, and more.
Stargazer Goblin launch malware distribution-as-a-service via GitHub
The operation is using over 3,000 fake GitHub accounts.
North Korean APT45 expanding into financially-motivated operations
The threat actor has been observed targeting critical infrastructure more frequently than other North Korean hackers.