# CrushFTP unauthenticated access via exposed HTTP interface

Published: 2026-06-09 · Severity: routine · Sectors: government-national, technology, infrastructure
Canonical: https://vorant.io/reports/afd6980c-cdd9-5b57-b7d6-b20d38657ccf/crushftp-unauthenticated-access-via-exposed-http-interface

> Unauthenticated vulnerability in CrushFTP v10-v11 web interface enables remote code execution; not yet exploited in wild.

A vulnerability in CrushFTP v10 and v11 allows unauthenticated access through an exposed HTTP(S) port on the web interface, enabling initial access to the system. Successful exploitation grants an attacker remote code execution capabilities on the compromised server, allowing installation of programs, data manipulation, deletion, and creation of new accounts with full administrative privileges. The vulnerability affects the web-facing interface and can be mitigated by enabling CrushFTP's DMZ feature. CIS-ISAC reports no active exploitation in the wild as of the advisory date. CrushFTP is a proprietary multi-protocol file transfer server used in government, business, and other sectors for file management operations.

## Detection guidance (public sample)

### CrushFTP Process Spawning Shell or Download Utility

ATT&CK: T1190

CrushFTP service or its bundled Java runtime spawning a command interpreter or LOLBin, indicating possible remote code execution via the exposed web interface. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: CrushFTP Process Spawning Shell or Download Utility
id: 79130192-9c08-5d55-99f6-ca5021cf603f
status: experimental
description: Detects the CrushFTP server process (or its bundled Java runtime under
  a CrushFTP directory) spawning a command interpreter or common download/execution
  utility. A server-side RCE through the exposed web interface would typically show
  this parent/child relation. Matches on the parent/child pattern, not specific payloads.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-crushftp-could-allow-for-unauthorized-access_2025-032
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: crushftp
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \curl.exe
  condition: selection_parent and selection_child
falsepositives:
- CrushFTP administrators configuring jobs or event actions that deliberately launch
  scripts via cmd.exe
- Software updater or installer routines for CrushFTP invoking cmd.exe
level: high
author: Vorant
```

### CrushFTP Process Creating Local Account or Adding Administrator

ATT&CK: T1190

CrushFTP process spawning net/net1 to create a local user or add to the administrators group, matching post-exploitation account creation after web interface compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: CrushFTP Process Creating Local Account or Adding Administrator
id: 3424a864-8a8c-54c4-b89b-980bca45f9f6
status: experimental
description: Detects a CrushFTP process (or Java runtime under a CrushFTP path) launching
  net.exe or net1.exe to add a user or modify the local Administrators group. The
  advisory notes attackers can create new accounts with full administrative privileges
  after exploiting the exposed web interface.
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-crushftp-could-allow-for-unauthorized-access_2025-032
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: crushftp
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_cmd:
    CommandLine|contains:
    - ' user '
    - ' localgroup '
  selection_action:
    CommandLine|contains:
    - /add
    - administrators
  condition: selection_parent and selection_img and selection_cmd and selection_action
falsepositives:
- Provisioning scripts deliberately invoked from CrushFTP event actions to create
  service accounts
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-crushftp-could-allow-for-unauthorized-access_2025-032

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/afd6980c-cdd9-5b57-b7d6-b20d38657ccf/crushftp-unauthenticated-access-via-exposed-http-interface.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup