CrushFTP, a widely used file transfer server, is under heightened scrutiny after two major security flaws were discovered. The vulnerabilities, tracked as CVE-2025-32102 and CVE-2025-32103, make the server susceptible to Server-Side Request Forgery (SSRF) and Directory Traversal attacks, respectively.

SSRF Vulnerability(CVE-2025-32102)

CrushFTP’s /WebInterface/function/ endpoint includes a telnet-based connectivity testing feature, exposing the telnetSocket command with configurable host and port parameters. Due to insufficient input validation, an attacker can manipulate these fields to initiate arbitrary connections to internal or external systems. The application’s responses—such as “Connected” or “Connection refused”—can reveal port status, enabling internal network reconnaissance and port scanning. This behavior aligns with a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918.

By submitting crafted POST requests with altered host and port parameters, attackers can determine whether specific ports are open or closed. For example, a request to 127.0.0.1:8080 may generate a “Connected” response, whereas 127.0.0.1:8888 might return “Connection refused.” This stealthy scanning technique can expose internal services, which may assist in further exploitation, especially in cloud environments where sensitive endpoints, such as metadata APIs or administrative interfaces, are accessible internally.

The proof-of-concept showcases a POST request to the /WebInterface/function/ endpoint utilizing the telnetSocket command. By modifying inputs like host=127.0.0.1 and port=8080, the server’s response indicates connection success or failure. These responses are wrapped in XML tags, allowing easy automation through scripting. The exploit can be executed without full authentication if the attacker possesses valid session cookies or if the administrative interface is publicly accessible.

Directory Traversal (CVE-2025-32103):

The directory traversal flaw stems from how CrushFTP processes file path inputs via the /WebInterface/function/ endpoint. Specifically, the getAdminXMLListing command—intended to display directory contents—does not properly sanitize UNC path inputs. Instead of supplying a standard local path (e.g., C:/data), an attacker can insert a UNC path like \\server\resource, granting access to remote SMB shares.

This vulnerability arises from the application’s failure to validate or restrict external file system references, enabling access to directories outside the local machine’s intended security boundaries. Crucially, this behavior circumvents the SecurityManager—CrushFTP’s primary access control mechanism—rendering its policy enforcement ineffective in preventing unauthorized directory traversal.

The proof-of-concept involves sending a POST request with the parameter path=\\\\vboxsrv\\demo using the getAdminXMLListing function. The server responds with an XML-based directory listing from the SMB share, including metadata such as name, href_path, root_dir, and privs, confirming successful enumeration of the remote file system.

Conclusion:

These vulnerabilities highlight ongoing weaknesses in input validation within critical web-facing components. The SSRF issue exploits telnet-based connectivity checks to circumvent network boundaries, while the directory traversal flaw enables access to internal or remote file systems through UNC path injection. Both exploits require minimal technical expertise, emphasizing the urgent need for strict input sanitization and robust access controls in administrative web interfaces.