CrushFTP WebInterface Alternative Channel Authentication Bypass (CVE-2025-54309)
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
Suricata
