Security readout for executives and security teams
Plain-English summary
CVE-2024-4040 lets unauthenticated attackers compromise vulnerable CrushFTP servers. The reported impact includes reading files outside the intended sandbox, bypassing authentication to gain administrative access, and remote code execution. Because CISA KEV lists it, treat exposed CrushFTP as an urgent incident-risk item, not routine patching.
Executive priority
Immediate priority. This is a critical, remotely exploitable file-transfer-server vulnerability with confirmed KEV status. Patch exposed systems urgently and treat vulnerable internet-facing instances as candidates for compromise review.
Technical view
The vulnerability is server-side template injection in CrushFTP before 10.7.1 and 11.1.0, across platforms. CVSS 9.8 reflects network access, low complexity, no privileges, and no user interaction. Sources describe full server compromise potential through file disclosure, authentication bypass, administrative access, and code execution.
Likely exposure
Organizations running CrushFTP versions earlier than 10.7.1 or 11.1.0 are exposed, especially internet-facing managed file transfer servers. The bundle does not provide CPEs or a complete asset-discovery method, so validate by inventory, vendor version checks, and exposure review.
Exploitation context
Active exploitation is supported by CISA KEV and cited public reporting. Public exploit-related material is also referenced in the source bundle. Do not assume compromise solely from version presence, but exposed vulnerable systems warrant urgent investigation and remediation.
Researcher notes
Evidence is strong for affected version boundaries, impact, severity, and active exploitation. The source bundle does not include detailed forensic indicators or definitive post-compromise checks, so validation should combine version review, exposure mapping, logs, account review, and vendor guidance.
Mitigation direction
- Upgrade CrushFTP to 10.7.1, 11.1.0, or later vendor-supported releases.
- Prioritize internet-facing CrushFTP systems before internal-only deployments.
- Restrict external access until patched and reviewed.
- Check CrushFTP vendor advisories for current guidance and platform-specific instructions.
- Review administrative accounts and configuration for unauthorized changes.
Validation and detection
- Inventory all CrushFTP servers and record exact versions.
- Confirm whether any instance runs below 10.7.1 or 11.1.0.
- Identify which instances are reachable from the internet.
- Review logs for unexpected admin access, configuration changes, or unusual file access.
- Check for unexplained system changes consistent with server compromise.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-4040 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=UpdateCVE reference · vendor-advisory
- https://www.crushftp.com/crush10wiki/Wiki.jsp?page=UpdateCVE reference · vendor-advisory
- https://www.reddit.com/r/cybersecurity/comments/1c850i2/all_versions_of_crush_ftp_are_vulnerable/CVE reference · related
- https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/CVE reference · media-coverage
- https://www.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/CVE reference · third-party-advisory
- https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/CVE reference · third-party-advisory
- https://github.com/airbus-cert/CVE-2024-4040CVE reference · exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4040CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.