## https://sploitus.com/exploit?id=B87DE643-184D-52C1-BC28-24F6A7571A0F
# CVE-2024-4040 — CrushFTP Authentication Bypass Exploit
This repository contains a stealthy Python proof-of-concept (PoC) exploit for **CVE-2024-4040**, a critical vulnerability in CrushFTP (v10 and below) that allows an attacker to bypass authentication using a forged `CrushAuth` cookie and AWS-style `Authorization` header.
## 🚨 Vulnerability Summary
> An unauthenticated attacker can bypass authentication in vulnerable CrushFTP instances by crafting a specific cookie/header combination, gaining unauthorized access to internal web functions.
- **CVE ID**: [CVE-2024-4040](https://nvd.nist.gov/vuln/detail/CVE-2024-4040)
- **Severity**: Critical (CVSS 9.8)
- **Affected**: CrushFTP v10.x (prior to official patch)
---
## ⚙️ Features
- ✅ Python 3.x PoC
- ✅ Secure `CrushAuth` generation using `secrets`
- ✅ Valid AWS-style spoofed `Authorization` header
- ✅ Built-in SSL bypass with suppression
- ✅ No external dependencies (only `requests`)
- ✅ Clean console output with status and detection
---
## 🛠 Usage
```bash
python3 CVE-2024-4040.py http://target-ip:8080 --valid_username crushadmin
```
`target_url` — Base URL of the CrushFTP server
`--valid_username` — Known valid user (default: crushadmin)
---
🔍 Example Output
```
[*] CrushFTP Authentication Bypass Exploit
[*] Targeting: http://192.168.1.10:8080
[*] Using username: crushadmin
[+] Exploit Result:
Status_Code : 200
Response_Text : {"getUserNameResponse":{"user_name":"crushadmin"}}
[+] CrushFTP Server is VULNERABLE!
```
---
## ⚠️ Legal Notice
This code is for educational and authorized security testing purposes only.
Do not use against systems you do not own or have explicit permission to test.
---
## 🙏 Credits
PoC Refactor: illdeed