CrushFTP Prior to 10.5.1 Vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVE-2023-43177

Summary

CrushFTP, a file transfer server software, contains a vulnerability affecting versions prior to 10.5.1, which stems from improperly controlled modification of dynamically-determined object attributes. This flaw could lead to unauthorized changes and potentially compromise the integrity of the application. Users and administrators should be aware of this vulnerability and take appropriate measures, such as upgrading to the latest version, to safeguard their systems.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2023-43177
Created by Rapid7

CVE-2023-43177
Created by the-emmons

References