Urgent Security Alert: Critical Flaw in CrushFTP Puts Your Data at Risk (CVE-2025-31161)
What is CVE-2025-31161? CrushFTP is widely used by businesses to transfer files securely. CVE-2025-31161 is a critical flaw that impacts CrushFTP versions 10 (up to 10.8.3) and 11 (up to 11.3.0). The flaw is a type of authentication bypass, meaning attackers can skip the login process altogether. It’s easy for attackers to exploit remotely, requires no special access or user interaction, and can lead to the complete loss of data privacy, integrity, and system availability. It has a severity rating of 9.8 (“Critical”) in the Common Vulnerability Scoring System (CVSS). Initial confusion caused this vulnerability to be briefly identified as CVE-2025-2825, but the official and correct designation is CVE-2025-31161. How does this attack work? The problem lies in how CrushFTP handles certain security checks for incoming web requests. Essentially, there’s a small window during the login process where an attacker can trick the system. Here’s a quick explanation of how it works. A flaw in the security check CrushFTP has a specific part of its code that checks for secure login information. However, there’s a subtle error where an internal setting is accidentally set to “true” by default. Bypassing the password If the username in the attacker’s fake login information doesn’t contain a specific character (the tilde ‘~’), this “true” setting tells the system to skip the password check entirely. This means an attacker can log in as a legitimate user without knowing their password. Crafting a malicious request Attackers send a custom web request to the CrushFTP server, which includes fake security information and a specific cookie. By combining these elements, the attacker can trigger the vulnerability and gain unauthorized administrative access. Is your software vulnerable? Your CrushFTP version Is it vulnerable? Action required 10.0.0 through 10.8.3 YES Update immediately 11.0.0 through 11.3.0 YES Update immediately 10.8.4 or higher NO (it’s patched!) Verify your version 11.3.1 or higher NO (it’s patched!) Verify your version Evidence of active exploitation Active exploitation was reported shortly after the patches were released, with security firms observing widespread attacks as early as March 30-31, 2025. Initially, over 1,500 vulnerable CrushFTP instances were exposed online, with significant numbers in the United States. In the following weeks, hundreds of organizations remained unpatched. Upon successful entry, attackers often establish persistent access. This is done by creating new administrator accounts or deploying Remote Monitoring and Management (RMM) tools, such as MeshAgent or MeshCentral, and AnyDesk. Attackers also deploy Telegram bot binaries to steal system information and sensitive data. The “Kill Security” (or “Kill”) ransomware group has publicly claimed responsibility for some early exploitation efforts, announcing that they’ve obtained “significant volumes of sensitive data” and intend to extort victims. It highlights a trend where Managed File Transfer (MFT) solutions are increasingly targeted by ransomware and data extortion groups for their high-value data. The impact of a successful attack A successful exploit grants attackers unauthenticated administrative access, which has severe consequences: Full system compromise: Attackers can gain complete control over the CrushFTP application and the server it runs on. Data exfiltration: They can access and steal any sensitive data stored on the platform or accessible through it. Data integrity and ransomware: Attackers can modify, delete, or encrypt files, potentially deploying ransomware to disrupt operations and demand payments. Legal and regulatory implications: Organizations may face significant fines, reputational damage, and legal liabilities if personal data is compromised, with strict notification deadlines (e.g. 72 hours under GDPR). How to protect your organization The attack’s multi-layered approach combines technical exploitation with advanced social engineering to bypass security controls and user vigilance. It’s essential to take the following steps to protect your organization. Apply updates immediately UPDATE NOW: Immediately update all CrushFTP installations to version 10.8.4 or later or 11.3.1 or later. Only obtain updates from the official CrushFTP website. Deploy patches: CrushFTP doesn’t have automatic updates, so enterprises need to apply proactive, centralized patching. Verify updates: Ensure updates are successfully applied across your environment. Be proactive with security measures and hardening Enforce strong passwords: Mandate strong, unique passwords for all CrushFTP accounts, especially administrators. Monitor logs comprehensively: Actively monitor CrushFTP server logs (especially \logs\session_logs) for suspicious activity, like new accounts, unusual access, or RMM tool deployments. Layer your security: Employ strong email and web filtering, advanced endpoint detection and response (EDR), and network segmentation. Restrict network access: Limit CrushFTP access to only trusted clients and IP ranges. Assess and remediate compromise Applying the patch alone will not remove any existing access gained by attackers who exploited the vulnerability before the software update. Given active exploitation has been confirmed, you should assume potential prior compromise and take the following steps: Assess for unauthorized access: If you were running a vulnerable version, conduct a thorough assessment immediately for signs of compromise going back to at least March 30, 2025. Conduct forensic analysis: Examine server logs for new user accounts, modified user properties, or deployed RMM tools and malware. Remediate existing compromises: Remove unauthorized accounts, change all legitimate CrushFTP passwords, and remove any deployed malware. If necessary, restore systems from clean, verified backups. Address legal obligations: If a data breach is confirmed, promptly fulfill data protection (e.g. GDPR) and industry-specific regulatory obligations, including potential notifications. This vulnerability highlights the need to continuously monitor systems, stay informed about threats, and adopt a layered security approach to protect critical infrastructure. Conclusion The critical CrushFTP vulnerability puts a spotlight on the fast-paced world of cyber threats. In addition to patching and implementing security processes, it’s vital to run organizational exercises. Regularly practicing incident response through drills and simulations helps your team reinforce existing policies and processes. This preparation allows them to respond effectively when similar vulnerabilities emerge, reducing potential harm and protecting sensitive data. Share your thoughts Has your business been affected by the CVE-2025-31161 flaw or something similar? How do you stay up to date with the latest cyber threats and keep your team alert to risks? Let us know in the comments below.Understanding CVE-2024-21412: A Zero-Day Exploit Targeting Windows Users
What is CVE-2024-21412? CVE-2024-21412 is a security feature bypass vulnerability in Windows Defender SmartScreen. SmartScreen typically evaluates the safety of downloaded files and displays warnings for unrecognised or suspicious ones. But this vulnerability allows attackers to circumvent warnings and install malware on unsuspecting systems. Which systems are affected? CVE-2024-21412 impacts a broad range of Windows systems, including: Windows 10 (various versions) Windows 11 (various versions) Windows Server 2019 and later versions How can this vulnerability be used against your systems? Attackers exploited CVE-2024-21412 by crafting a Windows Internet shortcut (.url file) that pointed to another .url file on a remote SMB share. This technique tricked the system into automatically executing the file at the final location, bypassing SmartScreen's security warnings. Researchers even created a proof-of-concept exploit, demonstrating how easy the vulnerability is to exploit. Attackers also abused the Microsoft Search Protocol (MSP) to deceive users. They crafted malicious links that appeared to point to local files, but in reality, connected to an attacker-controlled server. This tricked users into opening malicious files without realising they were downloading them from an external source. How to protect your organisation Microsoft addressed CVE-2024-21412 with a patch released in mid-February 2024. Installing this patch is crucial to mitigate the risk associated with this vulnerability. In addition to patching, organisations should implement comprehensive monitoring and detection systems to identify and mitigate threats across all stages of an attack. This includes using intrusion detection systems, firewalls, and security information and event management (SIEM) tools to monitor network traffic and system activity for suspicious behaviour. Organisations should also consider employing advanced real-time behaviour analytics to monitor unusual activity and identify potential threats, even when they bypass traditional security measures. This involves analysing user and system behaviour patterns to detect anomalies that could indicate an attack. Conclusion CVE-2024-21412 highlights the importance of cybersecurity awareness and proactive measures, which can be mitigated with improved organisational cyber resilience and regular patching policies. As always, staying informed about potential vulnerabilities is a crucial step in reducing the risk of your organisation being attacked. Recommended content To learn how to detect this vulnerability in a sandboxed environment, check out the following lab: CVE-2024-21412 (SmartScreen Bypass) – Elastic Log Analysis. In this lab, you'll use ElasticSearch to detect the presence of malicious URL files in logs. Share your thoughts Have you seen this vulnerability being exploited in the wild? Have you patched your systems yet? Share your thoughts by commenting in the thread below.Understanding CVE-2023-49103: A Critical Vulnerability in ownCloud Graph API
ownCloud is a widely used open-source platform designed for file synchronization, sharing, and collaboration. It allows organizations to host their own cloud storage, ensuring data sovereignty and compliance with privacy regulations. Its flexibility and rich feature set have made it popular among enterprises and individual users alike. However, as with any software, vulnerabilities can emerge, and in late 2023, a critical security flaw – CVE-2023-49103 – was discovered in its Graph API application. This flaw could allow unauthorized access to sensitive configuration details, such as admin passwords, mail server credentials, and license keys. The risk is especially severe for organizations using ownCloud in containerized environments, where environment variables may be exposed. Let’s break down the vulnerability, its impact, and mitigation steps. Details of the vulnerability The vulnerability resides in the graphapi application of ownCloud. It leverages a third-party library file, GetPhpInfo.php, which calls the PHP phpinfo() function. This function, while commonly used for debugging, outputs detailed information about the server’s PHP configuration. In containerized deployments, environment variables – which often include sensitive information – are exposed, posing a severe security risk. Docker-based deployments of ownCloud are particularly susceptible, as Docker containers often rely on environment variables to pass sensitive information like database credentials and API keys during runtime. Attackers exploiting this vulnerability can use the phpinfo() output to capture these details, potentially compromising the entire containerized setup. Even disabling the graphapi app doesn’t fully mitigate the issue, as the vulnerable file remains accessible unless explicitly removed. Impact of CVE-2023-49103 When exploited, this vulnerability allows attackers to extract sensitive information without requiring authentication. The exposed data could include: ownCloud administrator passwords Mail server credentials Database credentials ownCloud license key Such information disclosures could lead to data breaches, unauthorized access to critical systems, and further exploitation of the organization’s infrastructure. Exploitation in the wild This vulnerability has been actively exploited, highlighting the urgency for remediation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-49103 to its Known Exploited Vulnerabilities (KEV) Catalog, emphasizing the need for immediate action by affected organizations. Steps to mitigate the vulnerability If your organization uses ownCloud, the following steps are advised to mitigate the risk posed by CVE-2023-49103: Update the Graph API application Upgrade to version 0.3.1 or later of the graphapi app. The updated version removes the vulnerable GetPhpInfo.php file, addressing the root cause of the issue. Remove the vulnerable file If upgrading isn’t immediately possible, manually delete the file located at: owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php Disable the phpinfo() function Modify your PHP configuration to disable the phpinfo() function. This precaution reduces the risk of similar vulnerabilities in the future. Change all exposed credentials Immediately rotate any credentials that may have been exposed, including: Admin passwords Mail server logins Database credentials API and storage keys Secure Docker environments For Docker-based deployments, use secret management tools like Docker Secrets or HashiCorp Vault to handle sensitive data instead of relying on environment variables. Limit access to containerized services and ensure proper network segmentation. Regularly scan Docker images for vulnerabilities and keep them updated. Keep your ownCloud server updated Ensure your ownCloud instance is running the latest server version, as updates often include critical security patches. Proactive security measures While addressing CVE-2023-49103 is essential, organizations should adopt broader security measures to prevent similar risks in the future: Conduct regular security audits Routine assessments can identify vulnerabilities before they are exploited. Implement environment variable best practices Minimize sensitive data stored in environment variables and use secret management tools. Utilize web application firewalls (WAFs) WAFs can help block unauthorized access attempts. Train teams on security protocols Ensure your IT teams are aware of emerging threats and understand mitigation strategies. Recommended content The Immersive Labs catalog includes a lab dedicated to CVE-2023-49103. This lab provides a vulnerable version of ownCloud hosted within a vulnerable Docker container. This lab offers an in-depth understanding of the vulnerability and its associated exploit through practical, hands-on experience. You’ll exploit the vulnerable instance to gain access to sensitive information, allowing you unauthorized access to the system as a privileged user. Conclusion CVE-2023-49103 underscores the importance of proactive security measures in software deployment. For organizations leveraging ownCloud, this vulnerability serves as a reminder to maintain vigilance, regularly update systems, and adopt comprehensive security practices. By promptly addressing the issue and implementing the recommended mitigations, organizations can safeguard their sensitive data and reduce the likelihood of compromise. Share your thoughts If this vulnerability impacted your organization, what steps did you take to fix it, and what changes have you made to prevent future issues?CVE-2024-5910: Understanding the Critical Expedition Vulnerability
CVE-2024-5910 is a critical vulnerability in Palo Alto Networks' Expedition tool, widely used for firewall configuration migrations. The flaw, stemming from missing authentication for a critical function, allows attackers with network access to the Expedition interface to gain administrative privileges without authorization. This issue (which has a CVSS score of 9.3!) represents a significant security risk, particularly for organizations using Expedition to manage sensitive configuration data. What is Expedition? Expedition simplifies the migration of firewall configurations from third-party systems to Palo Alto Networks devices. This process often involves importing sensitive credentials, secrets, and configurations, making the tool's security paramount. Exploit details The vulnerability could be exploited by sending crafted requests to reset the administrator password, granting attackers access to the system. Once inside, malicious actors could extract sensitive information, tamper with configurations, or launch further attacks against connected systems. Public proof of concept (PoC) code for exploiting this vulnerability is now available, increasing the urgency of mitigation measures. Which systems are affected? This vulnerability affects Expedition versions before 1.2.92, as detailed in the advisory from Palo Alto Networks. Systems that expose Expedition to the internet are at heightened risk, with recent scans identifying several instances accessible online. Mitigation steps Update Expedition: Upgrade to version 1.2.92 or later, where the vulnerability has been patched. Restrict access: Ensure that network access to the Expedition tool is limited to trusted hosts and users. There’s no valid reason for the tool to be accessible from untrusted networks. Change credentials: Rotate all administrator passwords, API keys, and firewall credentials processed through Expedition to mitigate potential compromises. Monitor for indicators of compromise (IoCs): Look for unusual activities in logs or changes to configurations, which may indicate exploitation. Recommended content To learn more about this vulnerability by interacting with it in a sandboxed environment, we have both offensive and a defensive labs in the platform. The offensive scenario allows you to perform the exploitation using the PoC, whereas our defensive scenario upskills users by describing how to identify the IoCs – giving participants a deep understanding of how the exploit would appear in their environment. To find these labs and others, simply type the relevant CVE number into the Immersive Labs Search Bar. Final thoughts CVE-2024-5910 underscores the importance of promptly addressing vulnerabilities in tools that manage critical infrastructure configurations. Organizations should also stay on top of new and emerging threats, patch affected systems immediately, and follow best practices for securing administrative tools like Expedition. Using the Immersive Labs platform, organizations can gain a deep understanding of the most critical vulnerabilities and exploits and prepare for them in a practical and safe setting. For more details from the affected vendor, refer to the official Palo Alto Networks security advisory.CVE-2024-30051: What You Need to Know
What is CVE-2024-30051? CVE-2024-30051 is a vulnerability in the Microsoft Windows Desktop Window Manager (DWM) Core Library that allows attackers to gain SYSTEM-level privileges and execute arbitrary code, giving them extensive control over the compromised system. Which systems are affected? CVE-2024-30051 impacts a broad range of Windows systems, including: Windows 10 (various versions) Windows 11 (various versions) Windows Server 2016 and later versions For a precise list of affected product configurations, check out the NIST National Vulnerability Database. How could bad actors use this security issue? Attackers have already exploited CVE-2024-30051 in real-world attacks, using it to distribute Qakbot malware via malicious email attachments or compromised websites. Once the malicious code is executed, the vulnerability is used to escalate privileges, allowing deep system access for installing more malware, stealing sensitive data, or taking full control of the system. How to protect your organisation The simplest and most obvious method is to apply the latest Windows security updates as soon as they become available. Microsoft released patches addressing CVE-2024-30051 as part of its May 2024 Patch Tuesday updates. Organisations and users are strongly advised to apply these patches immediately to protect their systems from potential exploitation. To verify if you've been affected by this vulnerability, analyse your logs for suspicious activity. Specifically, look for DLLs loaded from locations outside of system32 by legitimate Windows processes, as this may indicate the CVE-2024-30051 exploit has been used to load a malicious DLL. Additionally, to mitigate against future vulnerabilities, educate users about the risks of phishing and malware. Qakbot is often spread through email attachments or malicious websites. Educate users about the risks of opening attachments from unknown senders or clicking on suspicious links in emails. Conclusion CVE-2024-30051 highlights the importance of cybersecurity awareness and proactive measures as it can be mitigated with organisational cyber awareness and regular patching policies. As always, staying informed about potential vulnerabilities is crucial to mitigating such risks. Recommended content If you’d like to learn how to detect this vulnerability in a sandboxed environment, check out our CVE-2024-30051 lab. In this lab, you'll threat hunt through a SIEM system to identify indicators of compromise (IoCs). Don’t forget you can seek help and collaboration with this lab content in our Help & Support Forum! Share your thoughts If CVE-2024-30051 has impacted your organization, we’d love to hear about your steps to mitigate the risk. Do you have any recommendations for preparing for similar vulnerabilities in the future?Understanding CVE-2024-3094: A Major Software Security Issue in XZ Utils
What is CVE-2024-3094? Recently, a critical security problem, known as CVE-2024-3094, was found in the XZ Utils library. XZ Utils is a set of open-source command-line tools and libraries for lossless data compression on various Linux systems. If your systems are running Linux or Mac, your OS likely uses it in the background when unpacking archives, and even if you’re using Windows, most of your services will use XZ Utils. This code allowed for SSH backdoor access and remote code execution on affected systems, earning a maximum CVSS score of 10. The harmful code was hidden within the XZ Utils software by a ‘trusted’ developer, starting with version 5.6.0. This developer was actually a bad actor who gained the trust of the sole maintainer of the code over many years of social engineering with multiple fake identities created to convince the maintainer that they were trustworthy. To learn more, check out the emails on research.swtch.com . Which Linux systems are affected? The compromised versions of XZ have been found in certain versions of Debian, Kali Linux, OpenSUSE, Arch Linux, and Fedora: Debian: Unstable/Sid versions from 5.5.1alpha-0.1 to 5.1.1-1 Kali Linux: Systems updated between March 26-29, 2024 OpenSUSE: Rolling releases Tumbleweed and MicroOS between March 7-28, 2024 Arch Linux: Versions 2024.03.01, VM images from late February to late March 2024 Fedora: Rawhide and Fedora 40 Beta Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094 How could this security issue be used by bad actors? Attackers could exploit this vulnerability by taking advantage of the backdoor inserted into the XZ Utils library. With this vulnerability, they can: Exploit the backdoor: Using the backdoor, attackers could bypass SSH authentication, allowing them to gain access to the system without needing valid credentials. Elevate privileges: Once inside, attackers could attempt to gain higher-level access, enabling them to control more parts of the system. Establish persistence: Attackers might install persistent malware to maintain access to the compromised system. Spread laterally: From the initial compromised system, attackers could move laterally within the network, targeting other systems and spreading their control. Steal sensitive data: Attackers could access and exfiltrate sensitive data, such as personal information, financial records, or intellectual property. Disrupt operations: By tampering with critical services or data, attackers could disrupt business operations, leading to downtime and financial losses. Deploy ransomware: Attackers could encrypt critical data and demand a ransom for its decryption, causing further damage and financial loss. How to protect your systems To protect your systems from this vulnerability, you should verify if your systems are using the compromised versions of XZ Utils and keep up with the latest advice from vendors. If your systems contain the mentioned versions, make sure you update to at least version 5.6.1-2. You’ll also want to ensure proper security hygiene by keeping all other software up to date with the latest security patches. Finally, make sure your IT and security teams understand this vulnerability, are able to fix it, and know how to respond to potential threats. Conclusion CVE-2024-3094 highlights the importance of securing the software supply chain. By understanding this security issue and taking proactive steps, you can better protect your systems from sophisticated attacks. Keep your systems updated, improve your organizational resilience, and consult with your software vendors for the latest security information. Recommended content If you’d like to know more, we have an XZ Utils Lab in the latest CVEs collection. In the lab, you'll take on the role of a CIRT analyst researching backdoor deployment techniques. Share your thoughts If this vulnerability impacted your organization, what steps did you take to fix it, and what changes have you made to prevent future issues? Comment and collaborate with others in the comments!
