CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)

Metadata

Affected Target

Summary

CrushFTP’s web interface trusts the presence of the HTTP headers X-DMZ-Proxy: disabled and X-AS2-Version: 1.0 (plus a matching User-Agent) as proof that a request originates from an already-authenticated AS2 (Applicability Statement 2 / EDI-over-HTTP) proxy path, and grants administrative access without validating any credentials. The root cause is that the server performs no cryptographic or origin verification of these headers — merely sending them from an arbitrary client is sufficient to reach /WebInterface/admin/*. The researcher further reverse-engineered CrushFTP’s session cookie scheme, finding that the currentAuth cookie is deterministically the last four characters of the CrushAuth session ID, making full session establishment 100% reproducible once the header bypass grants initial access. The repository ships three shell-based PoC scripts, Snort/Suricata detection rules, and a detailed technical writeup. The author explicitly notes this is independent research and that the exact mapping to CVE-2025-54309 is speculative, since CrushFTP silently patched the issue without a detailed public advisory.

Vulnerability Details

Root Cause

The vulnerable logic (reconstructed by the researcher from behavior, illustrated as pseudocode in docs/TECHNICAL_ANALYSIS.md) unconditionally grants admin session state when the AS2 headers are present, with no verification that the request actually originated from a legitimate AS2/DMZ proxy:

1
2
3
4
5
6
7
8

// Pseudocode representing vulnerable logic
if (request.getHeader("X-DMZ-Proxy").equals("disabled") &&
    request.getHeader("X-AS2-Version") != null) {
    // VULNERABILITY: Bypass authentication
    session.setAttribute("authenticated", true);
    session.setAttribute("role", "admin");
    return ADMIN_ACCESS_GRANTED;
}

Separately, the session cookie generator ties the currentAuth cookie directly to the tail of the CrushAuth session ID (CrushAuth=[TIMESTAMP]_[SESSION_ID], currentAuth == SESSION_ID[-4:]), so once any cookie pair is observed (including the attacker’s own, established via the header bypass), the relationship between the two values is trivially derivable and reusable.

Attack Vector

1. Attacker sends a GET to /WebInterface/admin/index.html with X-DMZ-Proxy: disabled, X-AS2-Version: 1.0, and User-Agent: AS2Server/1.0 — the server returns the full ~19KB admin panel HTML with no prior authentication.
2. Attacker sends a POST to /WebInterface/function/ with command=getUsername (same AS2 headers), which causes the server to issue fresh CrushAuth and currentAuth session cookies for an authenticated administrative session.
3. Attacker extracts currentAuth and verifies it equals the last 4 characters of the CrushAuth session ID (mathematically guaranteed per the researcher’s testing).
4. Attacker replays the cookie pair against other admin endpoints (/WebInterface/admin/telnet.html, /WebInterface/Jobs/index.html, /WebInterface/UserManager/index.html, /WebInterface/PGP/index.html, /WebInterface/function/) to obtain full administrative functionality, including job scheduling (persistent command execution), user management, and PGP/credential access.

Impact

A completely unauthenticated, network-based attacker gains full CrushFTP administrative access: user/account creation, configuration changes, credential and PGP key disclosure, and — via scheduled jobs or the telnet/function interfaces — potential persistent remote command execution on the underlying host.

Environment / Lab Setup

Target:   CrushFTP 10.x (tested 10.5.x) / 11.x (tested 11.1.x) with AS2 support enabled,
          patched in CrushFTP 10.7.0+ / 11.2.0+ (November 2025)
Attacker: bash + curl (no special dependencies); optional Tor/SOCKS5 proxy for anonymization

Proof of Concept

PoC Script

See exploits/enhanced_session_exploit.sh, exploits/targeted_exploitation.sh, and exploits/adaptive_exploitation.sh in this folder.

1
2
3
4
5
6

./exploits/enhanced_session_exploit.sh TARGET_IP

curl -H "X-DMZ-Proxy: disabled" \
     -H "X-AS2-Version: 1.0" \
     -H "User-Agent: AS2Server/1.0" \
     "http://TARGET/WebInterface/admin/index.html"

Detection & Indicators of Compromise

grep -E "(X-DMZ-Proxy|X-AS2-Version|AS2Server)" /var/log/nginx/access.log
grep -E "(WebInterface/admin|WebInterface/function)" crushftp.log

See also detection/snort_rules.txt and detection/suricata_rules.txt for IDS signatures, and detection/log_analysis.sh for a ready-made log-scanning script.

Signs of compromise:

• Requests bearing X-DMZ-Proxy: disabled / X-AS2-Version: 1.0 / User-Agent: AS2Server/1.0 from sources that are not legitimate AS2 trading partners.
• Large (~19KB+) HTTP responses from /WebInterface/admin/* with no preceding login request.
• POST requests to /WebInterface/function/ with command=getUsername or other administrative commands immediately following an AS2-header request.
• New CrushAuth/currentAuth cookie pairs issued without a corresponding standard login event.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Smileyface101/CrushFTP-AS2-Bypass-Research-CVE-2025-54309 on 2026-07-06. Contains real shell exploit scripts, detection rules, and a detailed technical analysis; the author caveats that the exact CVE-2025-54309 mapping is speculative since it is independent research conducted without direct vendor confirmation.