CrushFTP VFS Sandbox Escape Vulnerability

PoC: CVE-2024-4040

Scanner for CVE-2024-4040

PoC: GenCrushSSTIExploit

is a PoC for CVE-2024-4040 tool for exploiting the SSTI vulnerability in CrushFTP

PoC: CVE-2024-4040

Exploit CrushFTP CVE-2024-4040

PoC: CVE-2024-4040-SSTI-LFI

CVE-2024-4040 CrushFTP SSTI LFI & Auth Bypass | Full Server Takeover

PoC: CrushFTP-SSTI-LFI-Proof-of-Concept

Proof-of-concept for CVE-2024-4040 (CrushFTP SSTI -> unauthenticated LFI) in a controlled CS443 lab environment - for educational/authorised use only.

PoC: CrushFTP10-Docker-CVE-2024-4040

A Dockerized setup for running a vulnerable CrushFTP 10 server instance (CVE-2024-4040).

PoC: CrushFTP-CVE-2024-4040-illdeed

Exploit for CVE-2024-4040 – Authentication bypass in CrushFTP via CrushAuth cookie and AWS-style header spoofing. Stealthy Python PoC with secure token generation, SSL bypass, and improved output.

PoC: CVE-2024-4040

CVE-2024-4040 PoC

PoC: CVE-2024-4040

CVE-2024-4040 PoC

PoC: CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

PoC: CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

PoC: CVE-2024-4040-CrushFTP-server

Exploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms

PoC: CVE-2024-4040

exploit for CVE-2024-4040

PoC: CVE-2024-4040

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

PoC: CVE-2024-4040-Scanner

Scanner of vulnerability on crushftp instance

PoC: CVE-2024-4040-RCE-POC

CVE-2024-4040 (CrushFTP VFS escape) or (CrushFTP unauthenticated RCE)

PoC: CVE-2024-4040

Exploit Tool to CrushFTP