CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution
Summary
CVE-2023-43177 is a critical vulnerability in CrushFTP. The vulnerability could potentially allow unauthenticated attackers with network access to the CrushFTP Instance to write files in the local file system and eventually in some versions could allow the executing of arbitrary system commands. Technical Details Based on the information shared in the original blog post at https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/, we embarked on an effort to gain a deeper
- CVE
- CVE-2023-43177
- Published
- Collected
--- id: 9303 title: "CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution" cve: CVE-2023-43177 source_domain: projectdiscovery.io source_url: "https://projectdiscovery.io/blog/crushftp-rce" published_at: "2023-12-09T13:52:00Z" tags: ["bug-bounty", "rce", "zero-day"] phying_url: "https://phying.com/item/9303" lang: en --- # CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution ## Summary CVE-2023-43177 is a critical vulnerability in CrushFTP. The vulnerability could potentially allow unauthenticated attackers with network access to the CrushFTP Instance to write files in the local file system and eventually in some versions could allow the executing of arbitrary system commands. Technical Details Based on the information shared in the original blog post at https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/, we embarked on an effort to gain a deeper ## Intelligence Metadata - **Sources:** projectdiscovery.io - **CVE:** CVE-2023-43177 - **Published:** 2023-12-09T13:52:00Z - **Original:** https://projectdiscovery.io/blog/crushftp-rce - **Phying News:** https://phying.com/item/9303