Create DIVD-2024-00003.md

Eerste versie van de casefile

_cases/2024/DIVD-2024-00003.md

@@ -0,0 +1,53 @@
+---
+layout: case  
+title: "Unauthenticaded Remote Code Execution in CrushFTP"
+excerpt: "CrushFTP versions 10.5.5 and lower are vulnerable for an unauthenticated remote code execution vulnerability"
+author: Alwin Warringa
+lead: Alwin Warringa
+researchers:
+- Alwin Warringa
+# You can use free text here as well. E.g. to indicate that some vulnerabilities don't have CVEs assigned (yet).
+cves:
+- CVE-2023-43177
+product: 
+- CrushFTP
+versions: all versions lower than 10.5.5
+- All supported versions
+recommendation: "While the patch is under development, apply Ivanti’s mitigation, or take the appliance offline."
+patch_status: "Patch available"
+workaround:" "Restrict access to the webinterface of CrushFTP."
+status : open
+start: 2023-12-13
+end: 
+timeline:
+- start: 2023-12-13
+  end:
+  event: "DIVD receives signals about a vulnerability in CrushFTP and starts fingerprinting."
+- start: 2024-01-15
+  end:
+  event: DIVD identified vulnerable devices
+- start: 2024-01-10
+  end:
+  event: Case opened, first version of this casefile.
+
+#ips: 
+# ips is used for statistics after the case is closed. If it is not applicable, you can set IPs to n/a (e.g. stolen credentials)
+# This field becomes mandatory when the case status is set to 'Closed'
+---
+## Summary
+CVE-2023-43177 is a critical vulnerability in CrushFTP. The vulnerability could potentially allow unauthenticated attackers with network access to the CrushFTP Instance to write files in the local file system and eventually in some versions could allow the executing of arbitrary system commands. 
+
+## What you can do
+Given that there is active exploitation, it is crucial the provided mitigation is applied as soon as possible or that the appliance is take offline until mitigations are available. It is also recommended to check the appliance for signs of previous exploitation. Upgrade CrushFTP to version 10.6.0 or higher. 
+
+## What we are doing
+DIVD has identified vulnerable systems and will notify owners of vulnerable systems. DIVD is also informing trusted information sharing partners for targeted notifications.
+
+{% comment %}  Leave this here, so we see a timeline{% endcomment %}
+{% include timeline.html %}
+
+## More information
+* [CrushFTP information](https://crushftp.com/crush10wiki/Wiki.jsp?page=Update)
+* [Project Discovery blog](https://blog.projectdiscovery.io/crushftp-rce/)
+* [NIST references](https://nvd.nist.gov/vuln/detail/CVE-2023-43177)
+* {% cve CVE-2023-43177 %}