CVE-2025-32102

Executive Summary

CVE-2025-32102 is a Server-Side Request Forgery (SSRF) vulnerability discovered in CrushFTP, a widely used file transfer application. The flaw resides in the /WebInterface/function/ URI, specifically within the telnetSocket command. By manipulating the host and port parameters, an unauthenticated attacker can force the server to make arbitrary outbound network requests. This can be leveraged to scan internal networks, interact with internal services, or potentially pivot to more severe attacks. The vulnerability affects CrushFTP versions 9.x, 10.x up to 10.8.4, and 11.x up to 11.3.1. At the time of analysis, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the CrushFTP software. Organizations using CrushFTP should treat this as a critical supply chain risk, as the software is often deployed as a managed service or internal infrastructure component.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The medium severity rating is due to the low impact on confidentiality and no impact on integrity or availability. However, in a real-world scenario, SSRF can be chained with other vulnerabilities (e.g., internal service exploitation, cloud metadata access) to achieve a much higher impact.

Deep Dive & Mechanics

The vulnerability is triggered by sending a crafted HTTP request to the /WebInterface/function/ endpoint with the command parameter set to telnetSocket. The application then attempts to open a raw TCP socket to the user-supplied host and port values. This functionality is intended for administrative or diagnostic purposes but lacks proper validation or sanitization of the target address.

Attack Flow:

1. An attacker sends a POST request to /WebInterface/function/ with parameters command=telnetSocket&host=internal.target&port=8080.
2. The CrushFTP server initiates a TCP connection to internal.target:8080.
3. The attacker can observe connection success/failure (via timing or response differences) to map internal services.
4. If the internal service returns data (e.g., HTTP response), the attacker may be able to read it through the response from CrushFTP.

Key Technical Details:

• The host parameter can be an IP address, hostname, or even a URL (depending on implementation).
• The port parameter is an integer.
• No authentication is required to trigger this functionality.
• The vulnerability is in the telnetSocket command handler, which likely uses a raw socket library (e.g., Java's Socket class).

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable pseudo-code
public void handleTelnetSocket(HttpRequest request) {
    String host = request.getParameter("host");
    int port = Integer.parseInt(request.getParameter("port"));
    Socket socket = new Socket(host, port);
    // ... read/write data
}

A patched version would include:

• Input validation (e.g., block private IP ranges, restrict to allowed hosts).
• Authentication requirement for this command.
• Use of a whitelist of allowed destinations.

// Patched pseudo-code
public void handleTelnetSocket(HttpRequest request) {
    if (!isAuthenticated(request)) {
        throw new SecurityException("Authentication required");
    }
    String host = request.getParameter("host");
    int port = Integer.parseInt(request.getParameter("port"));
    if (!isAllowedHost(host)) {
        throw new SecurityException("Host not allowed");
    }
    Socket socket = new Socket(host, port);
    // ... read/write data
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable CrushFTP instance (version 10.8.4 or 11.3.1) in a controlled environment.
2. Set up an internal listener (e.g., a simple HTTP server on port 8080) to simulate an internal service.
3. Use the following curl command to test the SSRF:

curl -X POST "http://target:8080/WebInterface/function/" \
  -d "command=telnetSocket&host=127.0.0.1&port=8080"

Exploitation Steps:

• Internal Port Scanning: Iterate through ports on internal hosts to identify running services.
• Cloud Metadata Access: If the CrushFTP server is hosted in a cloud environment (AWS, GCP, Azure), attempt to access the metadata endpoint (e.g., 169.254.169.254).
• Service Interaction: If an internal service returns data (e.g., a Redis or Memcached instance), the attacker may be able to read or write data.

Example for AWS Metadata:

curl -X POST "http://target:8080/WebInterface/function/" \
  -d "command=telnetSocket&host=169.254.169.254&port=80"

Blue Team

Detection & Response:

• Monitor for HTTP requests to /WebInterface/function/ with command=telnetSocket.
• Alert on outbound connections from the CrushFTP server to unexpected internal IPs or ports.
• Use network segmentation to limit the CrushFTP server's ability to reach internal resources.

Honeypot Strategy:

• Deploy a fake internal service (e.g., a TCP listener that logs all connections) to detect SSRF attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /WebInterface/function/ with parameters command=telnetSocket, host, and port.
  • Outbound TCP connections from the CrushFTP server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata IPs (169.254.169.254).
• Log IOCs:
  • CrushFTP access logs showing requests to /WebInterface/function/ with command=telnetSocket.
  • System logs showing unexpected outbound connections from the CrushFTP process.

Detection Engineering

YARA Rule

rule CVE_2025_32102_SSRF_CrushFTP {
    meta:
        description = "Detects SSRF exploitation attempts against CrushFTP CVE-2025-32102"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32102"
    strings:
        $s1 = "command=telnetSocket" ascii wide nocase
        $s2 = "host=" ascii wide nocase
        $s3 = "port=" ascii wide nocase
        $s4 = "/WebInterface/function/" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CrushFTP SSRF Exploitation Attempt (CVE-2025-32102)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting CrushFTP's telnetSocket command with host and port parameters.
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "command=telnetSocket"
            - "host="
            - "port="
        cs-uri-stem|contains: "/WebInterface/function/"
    condition: selection
falsepositives:
    - Legitimate administrative use (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32102 CrushFTP SSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/WebInterface/function/"; http_uri; content:"command=telnetSocket"; http_client_body; content:"host="; http_client_body; content:"port="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the telnetSocket command if not required, by modifying the CrushFTP configuration or using a reverse proxy to block requests to /WebInterface/function/ with command=telnetSocket.
2. Apply network segmentation to restrict the CrushFTP server's outbound access to only necessary external services.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Await an official patch from CrushFTP. In the meantime, consider upgrading to a version that is not affected (if available) or applying virtual patching via a Web Application Firewall (WAF).

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/WebInterface/function/" "chain,id:1001,deny,msg:'CrushFTP SSRF Attempt'"
SecRule ARGS:command "telnetSocket" "chain"
SecRule ARGS:host "!^$" "t:none"

Valters IT
Securing Digital Frontiers