CrushFTP Authentication Bypass (CVE-2025-31161)

Historical catalog analysis: CISA added this entry on April 07, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-31161 is an authentication bypass vulnerability (CWE-305) residing in the HTTP authorization header of CrushFTP. This flaw enables a remote, unauthenticated attacker to authenticate as any known or guessable user account—such as the crushadmin account—which could lead to a full system compromise.

Exposure and applicability

This vulnerability affects organizations deploying CrushFTP. The exposure path is network-based; an attacker can target the HTTP authorization header to bypass standard authentication mechanisms. Because this flaw allows access to administrative accounts, any instance of CrushFTP exposed to untrusted networks is at high risk. The source indicates that this vulnerability has been utilized in known ransomware campaigns.

Potential breach-prevention strategy

The reported entry path is a bypass of the HTTP authorization header, though the specific technical mechanism of the bypass remains unknown based on available data.

Our analysis suggests the following prioritized actions to reduce the likelihood of a similar compromise:

1. Restrict Administrative Interface Access: Limit access to administrative accounts (e.g., crushadmin) to trusted internal IP ranges or VPNs. This is a preventative control intended to block initial remote access. Responsible Role: Network Administrator. Verification can be performed by attempting to reach the admin interface from an external, unauthorized network.
2. Implement Strong Account Naming Conventions: Avoid using default or easily guessable usernames for high-privilege accounts. While this does not fix the bypass, it increases the difficulty for attackers to identify valid targets. Responsible Role: IAM Lead. Verification involves auditing the user list for common defaults.
3. Deploy Enhanced Authentication Logging: Configure logging to alert on successful authentications to administrative accounts originating from unusual locations or patterns. This is a detection control intended to limit damage by reducing dwell time. Responsible Role: SOC Analyst. Verification can be performed via a safe, authorized login attempt and confirming the resulting alert.

Remediation priorities

Defenders should prioritize the following actions based on vendor and CISA guidance:
* Immediate Mitigation: Apply all mitigations as specified in the vendor’s instructions.
* Cloud Service Review: For those utilizing cloud-based deployments, follow BOD 22-01 guidance to ensure exposure is minimized.
* Decommissioning: If mitigations cannot be applied or are unavailable for a specific environment, the product should be discontinued to eliminate the risk.

How to validate remediation

Verification must go beyond confirming a version number. To verify that the vulnerability has been mitigated, defenders should perform authorized testing of the HTTP authorization header behavior to ensure that unauthenticated requests cannot successfully impersonate known user accounts. A successful validation is one where the system rejects unauthorized authentication attempts via the header and requires valid credentials.

Limits and open questions

Applying a patch or mitigation could reduce the likelihood of exploitation, but it does not guarantee total prevention if other configuration weaknesses exist. It remains unclear exactly which versions are affected and the specific timeline of the original disclosure prior to its inclusion in the CISA catalog on April 7, 2025. Residual risk persists if administrative accounts remain exposed to the public internet regardless of the patch status.

Source and editorial note

CVE-2025-31161: CrushFTP Authentication Bypass Vulnerability · Source date: April 07, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 10, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 19, 2026 at 00:05 UTC.

Request a Vulnerability Assessment