Customers of the CrushFTP enterprise file switch software program are being urged to replace to the newest model following the invention of a safety flaw that has come underneath focused exploitation within the wild.
“CrushFTP v11 versions below 11.1 have a vulnerability where users can escape their VFS and download system files,” CrushFTP mentioned in an advisory launched Friday. “This has been patched in v11.1.0.”
That mentioned, clients who’re working their CrushFTP situations inside a DMZ (demilitarized zone) restricted setting are protected towards the assaults.
Simon Garrelou of Airbus CERT has been credited with discovering and reporting the flaw. It has but to be assigned a CVE identifier.
Cybersecurity firm CrowdStrike, in a publish shared on Reddit, mentioned it has noticed an exploit for the flaw getting used within the wild in a “targeted fashion.”
These intrusions are mentioned to have primarily focused U.S. entities, with the intelligence gathering exercise suspected to be politically motivated.
“CrushFTP users should continue to follow the vendor’s website for the most up-to-date instructions and prioritize patching,” CrowdStrike mentioned.
