CVE-2025-54309 — AI Deep Analysis Summary

🚨 **Essence**: CrushFTP suffers from an **AS2 validation flaw** allowing **Authentication Bypass**. <br>💥 **Consequences**: Remote attackers can bypass login checks to gain **Full Admin Access** without credentials.…

🛡️ **Root Cause**: **CWE-420** (Acceptance of Extraneous Untrusted Data). <br>🔍 **Flaw**: Logic error in `ServerSessionHTTP.java` (`loginCheckHeaderAuth`). The system fails to properly validate the `AS2-To` header.…

📦 **Affected Products**: **CrushFTP** (File Transfer Server).…

👑 **Attacker Capabilities**: <br>• **Privileges**: Gains **Administrator Rights** instantly. <br>• **Data**: Full read/write access to all files.…

📉 **Exploitation Threshold**: **LOW**. <br>🔑 **Auth**: **None** required (Unauthenticated). <br>⚙️ **Config**: Requires standard HTTPS access.…

💣 **Public Exploits**: **YES**. <br>🔥 **Wild Exploitation**: **Confirmed** (Exploited in the wild since July 2025).…

🔍 **Self-Check Methods**: <br>1. **Scan**: Use Nuclei template `code/cves/2025/CVE-2025-54309.yaml`. <br>2. **Verify**: Send HTTP request with empty/invalid `AS2-To` header. <br>3.…

🛠️ **Official Fix**: **YES**. <br>✅ **Patch Versions**: <br>• Upgrade to **CrushFTP 10.8.5** or later. <br>• Upgrade to **CrushFTP 11.3.4_23** or later.…

🚧 **No Patch Workaround**: <br>1. **Block Access**: Restrict HTTP/HTTPS access to trusted IPs only (WAF/ACL). <br>2. **Disable AS2**: If not used, disable AS2 features entirely. <br>3.…

🔴 **Priority**: **CRITICAL (Immediate Action)**. <br>⏱️ **Urgency**: **High**. <br>📉 **Reason**: CVSS 9.8, Unauthenticated, Wild Exploitation Active. <br>🚀 **Action**: Patch immediately.…