GobyVuls/CrushFTP_as2-to_Authentication_Permission_bypass_Vulnerability.md

CrushFTP as2-to Authentication Permission bypass Vulnerability (CVE-2023-43177)

Vulnerability	CrushFTP as2-to Authentication Permission bypass Vulnerability (CVE-2023-43177)
Chinese name	CrushFTP as2-to 认证权限绕过漏洞（CVE-2023-43177）
CVSS core	9.8
FOFA Query (click to view the results directly)	app="crushftp-WebInterface""
Number of assets affected	38695
Description	CrushFTP is a powerful file transfer server suitable for secure and efficient file transfer and management for individual or enterprise users.CrashFTP has a permission bypass vulnerability, where attackers can bypass system permission control by constructing malicious as2 to request authentication, achieving arbitrary execution of malicious operations such as file read and delete.
Impact	CrashFTP has a permission bypass vulnerability, where attackers can bypass system permission control by constructing malicious as2 to request authentication, achieving arbitrary execution of malicious operations such as file read and delete.