CVE-2024-4040 PoC — Unauthenticated arbitrary file read and remote code execution in CrushFTP

Description

A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).

Readme

# CrushFTP 10.0 Docker Deployment (vulnerable to CVE-2024-4040)

This repository provides a Dockerfile to build a Docker image and deploy a Linux container with a CrushFTP server that is vulnerable to the [CrushFTP VFS Sandbox Escape Vulnerability](https://nvd.nist.gov/vuln/detail/cve-2024-4040) (CVE-2024-4040).


> ⚠️ **Disclaimer**
> This repository is provided for educational and security research purposes only. The Docker image deploys a version of CrushFTP that is known to be vulnerable. Do not expose it to the internet or use it in production environments. The author is not affiliated with CrushFTP and assumes no responsibility for misuse.

---
## How to deploy the vulnerable CrushFTP server?

### 1. Build the image from the Dockerfile

```
docker build -t cve-2024-4040-crushftp10 .
```

### 2. Create and run the container from the image
```
docker run -dit -p 22:22 -p 21:21 -p 8080:8080 -p 9090:9090 -p 443:443 --name CVE-2024-4040-CrushFTP10 cve-2024-4040-crushftp10
```

The service should be now running on ports 21, 22, 443, 8080 and 9090.

## How to exploit the vulnerability?
I recommend trying out [Stuub](https://github.com/Stuub)'s [CVE-2024-4040-SSTI-LFI-PoC](https://github.com/Stuub/CVE-2024-4040-SSTI-LFI-PoC) proof of concept.

File Snapshot

Remarks