---
id: 9303
title: "CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution"
cve: CVE-2023-43177
source_domain: projectdiscovery.io
source_url: "https://projectdiscovery.io/blog/crushftp-rce"
published_at: "2023-12-09T13:52:00Z"
tags: ["bug-bounty", "rce", "zero-day"]
phying_url: "https://phying.com/item/9303"
lang: en
---

# CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution

## Summary

CVE-2023-43177 is a critical vulnerability in CrushFTP. The vulnerability could potentially allow unauthenticated attackers with network access to the CrushFTP Instance to write files in the local file system and eventually in some versions could allow the executing of arbitrary system commands. Technical Details Based on the information shared in the original blog post at https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/, we embarked on an effort to gain a deeper

## Intelligence Metadata

- **Sources:** projectdiscovery.io
- **CVE:** CVE-2023-43177
- **Published:** 2023-12-09T13:52:00Z
- **Original:** https://projectdiscovery.io/blog/crushftp-rce
- **Phying News:** https://phying.com/item/9303