How to find CrushFTP services


Latest CrushFTP vulnerability #

CrushFTP disclosed that a vulnerability in their file transfer product allows an unauthenticated attacker to access the host's file system. No CVE has yet to be assigned for this issue and CrowdStrike has indicated that this issue is being actively exploited in the wild. Additional details can be found in this article by Sergiu Gatlan at BleepingComputer.

What is the impact? #

This issue affects all CrushFTP versions prior to 10.7.1 and CrushFTP 11 releases prior to patch 11.1.0. An unauthenticated attacker can abuse this issue to read files from the host's file system. 

Are updates or workarounds available? #

CrushFTP has released versions 10.7.1 and 11.1.0 to address this issue.

How do I find potentially vulnerable systems with runZero? #

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:


Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Rapid Response
How to find Palo Alto Network firewalls running PAN-OS 11.1, 11.0, and 10.2
Palo Alto Networks disclosed that versions of their PAN-OS software have a vulnerability allowing for remote command injection. Here's how to find...
Rapid Response
How to find outdated lighttpd services
Outdated versions of the open source lighttpd web server are vulnerable to a handful of security vulnerabilities
Rapid Response
How to find D-Link NAS Storage devices
D-Link has disclosed multiple vulnerabilities in their D-Link NAS Storage products. Here's how to find potentially impacted devices.
Rapid Response
How to find Brocade Fabric OS
On April 4, 2024, Broadcom disclosed a vulnerability in their Fabric OS operating system used in their Brocade storage networking devices. Here's...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved