CrushFTP Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in CrushFTP version 11.3.6_48. The issue arises in the Web-Based Server's file-sharing feature, which reflects filenames into an email body field without proper sanitization. This lack of sanitization allows for unintentional HTML injection.

Impact

The vulnerability allows users with 'Rename' permissions to inject HTML into filenames, which is then reflected to other users without their interaction, creating an unintentional HTML injection scenario.

Reproduction

To reproduce this vulnerability, upload a file to the CrushFTP server and rename it to include HTML tags, such as a header tag. After renaming, share the file and observe the injected HTML being rendered.

Remediation

Users are advised to update CrushFTP to version 11.3.7_60 or later, where this vulnerability has been addressed.