CrushFTP VFS Sandbox Escape Vulnerability (CVE-2024-4040)

What is the Vulnerability ?
A zero-day security vulnerability has been uncovered in an enterprise file-transfer software CrushFTP. The vulnerability tagged as CVE-2024-4040 is actively being exploited in targeted attacks and has also been added to the CISA Known Exploited Vulnerabilities (KEV) list. The vulnerability allows unauthenticated remote attackers to read files from the file system outside of the VFS Sandbox, gain administrative access, and perform remote code execution on the server.


What is the recommended Mitigation?


According to the …

attackers attacks cisa cisa known exploited vulnerabilities crushftp cve cve-2024 cve-2024-4040 enterprise escape exploited exploited vulnerabilities file files kev known exploited known exploited vulnerabilities list sandbox sandbox escape security security vulnerability software targeted attacks transfer unauthenticated uncovered vulnerabilities vulnerability what is zero-day