UPDATE: Over 1,400 CrushFTP servers exposed to the public internet are at risk due to a critical vulnerability. The flaw, tracked as CVE-2024-4040, is a server-side template injection (SSTI) vulnerability. This vulnerability was previously exploited as a zero-day and allows for a virtual file system (VFS) sandbox escape that can lead to arbitrary file reading and full remote code execution (RCE) on unpatched systems. Security researchers have described the flaw as fully unauthenticated and trivially exploitable, emphasizing its potential to bypass authentication for administrative access, executing code as root. The issue has drawn significant attention, with cybersecurity firms observing its exploitation in targeted attacks aimed at U.S. organizations, suggesting a politically motivated intelligence-gathering effort. Shodan scans reveal that over 5,000 CrushFTP servers are currently internet-exposed, though it’s unclear how many are vulnerable. Following the vulnerability disclosure and patch release by CrushFTP, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-4040 to its Known Exploited Vulnerabilities (KEV) catalog, directing U.S. federal agencies to secure their servers by no later than May 1, 2024. CrushFTP has responded by urging users to update their systems immediately and frequently check for the latest security updates. This situation underscores the importance of timely patching to protect sensitive data and infrastructure from potential cyber threats. CTIX analysts recommend that CrushFTP administrators ensure that they have updated their infrastructure and should conduct an internal investigation for evidence of exploitation if it hasn’t been patched.