CVE-2024-53552

Executive Summary

CVE-2024-53552 is a critical vulnerability in CrushFTP versions 10 before 10.8.3 and 11 before 11.2.3. The flaw resides in the password reset mechanism, which mishandles the process and allows an unauthenticated attacker to take over any user account, including administrative accounts. This vulnerability can lead to full compromise of the CrushFTP server, including data exfiltration, lateral movement, and ransomware deployment. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is high due to the simplicity of the attack vector.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Changed (C) – attacker gains control of the application
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows unauthenticated account takeover with no user interaction, making it highly exploitable.

Deep Dive & Mechanics

The vulnerability is a classic CWE-640: Weak Password Recovery Mechanism for Forgotten Password. In CrushFTP, the password reset flow does not properly validate the identity of the user requesting the reset. An attacker can manipulate the reset request to target any user account, including the admin account. The exact mechanics involve sending a crafted HTTP request to the password reset endpoint, bypassing the intended email verification or security question step. This allows the attacker to set a new password for the target account and then log in with full privileges.

The flaw is present in the PasswordReset servlet or similar component. The server fails to verify that the reset token or request is tied to the correct user session or email address. Instead, it accepts a user identifier (e.g., username or user ID) directly from the request without proper authorization.

Vulnerable vs. Patched Code

Vulnerable Code (CrushFTP 10 < 10.8.3):

// Vulnerable: No validation of user identity
public void resetPassword(HttpServletRequest request) {
    String username = request.getParameter("username");
    String newPassword = request.getParameter("newPassword");
    // Directly reset password without verifying ownership
    User user = userManager.getUser(username);
    user.setPassword(newPassword);
    userManager.saveUser(user);
}

Patched Code (CrushFTP 10.8.3):

// Patched: Validates reset token tied to user session
public void resetPassword(HttpServletRequest request) {
    String token = request.getParameter("token");
    String newPassword = request.getParameter("newPassword");
    // Verify token is valid and tied to a specific user
    ResetToken resetToken = tokenManager.validateToken(token);
    if (resetToken == null || resetToken.isExpired()) {
        throw new SecurityException("Invalid or expired token");
    }
    User user = resetToken.getUser();
    user.setPassword(newPassword);
    userManager.saveUser(user);
    tokenManager.invalidateToken(token);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable CrushFTP 10.8.2 instance on a local VM (e.g., using Docker or a manual install).
2. Ensure the server is accessible from the attacker machine.

Exploitation Steps:

1. Identify the password reset endpoint (e.g., /WebInterface/function/?command=resetPassword).
2. Craft a POST request with the target username (e.g., admin) and a new password.
3. Send the request using curl:

   curl -X POST -d "username=admin&newPassword=Hacked123!" http://target:8080/WebInterface/function/?command=resetPassword
   

4. Log in with the new password:

   curl -u admin:Hacked123! http://target:8080/WebInterface/
   

5. Once logged in, enumerate users, download files, or upload a web shell.

Blue Team

Detection Steps:

1. Monitor for unusual password reset requests, especially those without a valid token or session.
2. Look for multiple failed login attempts followed by a successful login with a new password.
3. Check logs for resetPassword commands without a corresponding email verification.

Hunting Query (Splunk):

index=crushftp sourcetype=access_log
| search "command=resetPassword"
| eval hasToken=if(match(uri, "token="), "yes", "no")
| where hasToken="no"
| stats count by src_ip, username

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /WebInterface/function/?command=resetPassword without a token parameter.
• Logs: Entries showing password reset for admin or other high-privilege accounts without prior email verification.
• File System: New files in the CrushFTP web root (e.g., /var/opt/CrushFTP/WebInterface/) uploaded by the attacker.
• User Accounts: New or modified user accounts with unexpected passwords.

Detection Engineering

YARA Rule

rule CVE_2024_53552_CrushFTP_Reset {
    meta:
        description = "Detects CrushFTP password reset requests without token"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53552"
    strings:
        $reset = "resetPassword" ascii wide nocase
        $no_token = "username=" ascii wide nocase
        $token = "token=" ascii wide nocase
    condition:
        $reset and $no_token and not $token
}

Sigma Rule

title: CrushFTP Password Reset Without Token
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to CrushFTP password reset endpoint without a token parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "command=resetPassword"
        cs-uri-query|contains: "username="
        cs-uri-query|contains: "token="
    condition: selection and not cs-uri-query|contains: "token="
falsepositives:
    - Legitimate password resets with token (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53552 CrushFTP Password Reset Without Token"; flow:to_server; content:"command=resetPassword"; http_uri; content:"username="; http_uri; content:!"token="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to CrushFTP 10.8.3 or 11.2.3 immediately.
2. If upgrade is not possible, disable the password reset feature temporarily by blocking the endpoint in the web server configuration (e.g., Apache/Nginx).
3. Review all user accounts for unauthorized changes and reset passwords for all users.

Long-term Mitigations:

• Implement multi-factor authentication (MFA) for all CrushFTP accounts.
• Restrict access to the CrushFTP web interface to trusted IPs only.
• Enable detailed logging and monitor for suspicious password reset activities.
• Conduct a security audit of the CrushFTP configuration and apply the principle of least privilege.

Valters IT