Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-31161

Quick assessment

Affected
CrushFTP CrushFTP
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CrushFTP是CrushFTP公司的一款文件传输服务器。 CrushFTP 10.8.4之前的10.x本和11.3.1之前的11.x版本存在安全漏洞，该漏洞源于认证绕过漏洞，可能导致账户接管。

CVSS 9.8 · Critical KEV · Ransomware EPSS 99.97% · P100

Public Exploits 2

ExploitDB · 1 EDB-52295 [remote]
Nuclei · 1 CVE-2025-31161.yaml [template]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-31161

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorization method of the HTTP component of the FTP server. The server first verifies the existence of the user by performing a call to login_user_pass() with no password requirement. This will authenticate the session through the HMAC verification process and up until the server checks for user verification once more. The vulnerability can be further stabilized, eliminating the need for successfully triggering a race condition, by sending a mangled AWS4-HMAC header. By providing only the username and a following slash (/), the server will successfully find a username, which triggers the successful anypass authentication process, but the server will fail to find the expected SignedHeaders entry, resulting in an index-out-of-bounds error that stops the code from reaching the session cleanup. Together, these issues make it trivial to authenticate as any known or guessable user (e.g., crushadmin), and can lead to a full compromise of the system by obtaining an administrative account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
CrushFTP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CrushFTP是CrushFTP公司的一款文件传输服务器。 CrushFTP 10.8.4之前的10.x本和11.3.1之前的11.x版本存在安全漏洞，该漏洞源于认证绕过漏洞，可能导致账户接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
CrushFTP CrushFTP 10 ~ 10.8.4 -

II. Public POCs for CVE-2025-31161

# POC Description Source Link Shenlong Link
1 Proof of Concept for CVE-2025-31161 / CVE-2025-2825 https://github.com/Immersive-Labs-Sec/CVE-2025-31161 POC Details
2 None https://github.com/llussiess/CVE-2025-31161 POC Details
3 CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31161.yaml POC Details
4 CrushFTP CVE-2025-31161 Exploit Tool 🔓 https://github.com/TX-One/CVE-2025-31161 POC Details
5 Official Nuclei template for CVE-2025-31161 (formerly CVE-2025-2825) https://github.com/SUPRAAA-1337/Nuclei_CVE-2025-31161_CVE-2025-2825 POC Details
6 CVE-2025-31161 python exploit https://github.com/SUPRAAA-1337/CVE-2025-31161_exploit POC Details
7 🛡️ CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit https://github.com/0xgh057r3c0n/CVE-2025-31161 POC Details
8 CVE-2025-31161 https://github.com/B1ack4sh/Blackash-CVE-2025-31161 POC Details
9 CrushFTP 11.3.1 - Authentication Bypass https://github.com/ibrahmsql/CVE-2025-31161 POC Details
10 None https://github.com/r0otk3r/CVE-2025-31161 POC Details
11 PoC CVE-2025-31161 - Authentication Bypass CrushFTP https://github.com/f4dee-backup/CVE-2025-31161 POC Details
12 Authentication bypass vulnerability in versions of the CrushFTP server. https://github.com/acan0007/CVE-2025-31161 POC Details
13 Scans target to see if its vulnerable to CVE-2025-31161 https://github.com/Teexo/CVE-2025-31161 POC Details
14 None https://github.com/0xDTC/CrushFTP-auth-bypass-CVE-2025-31161 POC Details
15 🛡️ CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit https://github.com/zr1p3r/CVE-2025-31161 POC Details
16 None https://github.com/cesarbtakeda/CVE-2025-31161 POC Details
17 CVE-2025-31161 https://github.com/Ashwesker/Blackash-CVE-2025-31161 POC Details
18 None https://github.com/ch3m1calspain/CVE-2025-31161 POC Details
19 CVE-2025-31161 https://github.com/Ashwesker/Ashwesker-CVE-2025-31161 POC Details
20 None https://github.com/ch3m1cl/CVE-2025-31161 POC Details
21 PoC Authentication Bypass to RCE to Exploit CVE-2025-31161 https://github.com/Dairrow/CVE-2025-31161 POC Details
22 CVE-2025-31161 https://github.com/Drelinss/Blackash-CVE-2025-31161 POC Details
23 A proof of concept for CVE-2025-31161, using mangled HTTP header to perform unauthenticated impersonation of any user in Crush FTP server. https://github.com/Shisones/CVE-2025-31161 POC Details
24 Wrote an exploit in Go for CVE-2025-31161 affecting crushFTP. https://github.com/eserror/CVE-2025-31161 POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-31161

请登录查看更多情报信息。

Security Blog Posts for CVE-2025-31161 (1)

IV. Related Vulnerabilities

Same product: CrushFTP
Same vendor: CrushFTP
Same weakness: CWE-305

V. Comments for CVE-2025-31161

No comments yet

Leave a comment