CrushFTP takeover (CVE-2025-54309): AS2 validation flaw to admin access

What happened

On 18 July 2025, CrushFTP disclosed CVE-2025-54309: CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 mishandled AS2 validation when the DMZ proxy feature was not in use, allowing remote attackers to obtain admin access.

CrushFTP's advisory urged same-day patching, noting that the file-transfer server typically sits directly on the internet with valuable data behind it. The vulnerability followed the familiar managed-file-transfer curse — MOVEit, GoAnywhere, and CrushFTP itself in prior years all drew mass-exploitation waves.

Impact

Admin access on a file-transfer server means reading, modifying, and exfiltrating every file in transit: supplier catalogs, EDI invoices, payroll drops, customer data feeds. Attackers also routinely plant scheduled jobs for persistence and use the host as a relay into the internal network.

Root cause in one paragraph

The AS2 message-validation path trusted fields it should have verified, and the resulting logic flaw escalated an unauthenticated network peer into an administrative session — the classic shape of a protocol-feature check that was tested for happy paths but never for hostile ones.

What to do now

• Upgrade to CrushFTP 10.8.5+ or 11.3.4_23+ immediately.
• Enable the DMZ proxy configuration if your deployment supports it — it was the unaffected architecture here.
• Review admin login logs for unknown sessions around disclosure week; rotate admin credentials.
• Inventory scheduled jobs and event rules for entries you did not create.
• If you run any managed file transfer facing the internet, subscribe to its security list — MFT flaws now get exploited within days, every time.

What this means for Magento stores

Catalog imports, ERP order drops, and payment reconciliation files often move through FTP/SFTP into Magento. If that hop runs on a vulnerable MFT server, poisoned catalog CSVs or skimmed payout files become your incident. Prefer SFTP with key auth, isolate the transfer host from the Magento app servers, and validate every imported file's shape before the indexer touches it.

Sources

• NVD: CVE-2025-54309
• CrushFTP release notes for 10.8.5 and 11.3.4_23

Next in this series: Adobe Commerce APSB25-50 patch roundup — /blog/cve-2025-adobe-commerce-apsb25-50