erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: March 21, 2025

2 editorial briefs and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild. Anyone running an internet-facing CrushFTP 10 or 11 server, particularly without the DMZ proxy instance in front.
  • Check exposure: Next.js Middleware Authorization Bypass (CVE-2025-29927). Teams self-hosting Next.js 11.1.4 through 15.2.2 with next start or output: 'standalone' whose middleware enforces authentication, authorization, redirects or security headers.
  • PyPI: 1 critical advisory (InvokeAI). Check with pip-audit (or: pip show <package>).
  • npm: 1 critical advisory (next). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-31161

CrushFTP Auth Bypass CVE-2025-31161 Exploited in the Wild

Fixed since March 2025 and widely exploited from early April; if you run CrushFTP, make sure you are on a current build (later CrushFTP flaws raised the minimum) and audit for backdoor admin accounts.

Must act: Anyone running an internet-facing CrushFTP 10 or 11 server, particularly without the DMZ proxy instance in front.

Can relax: Organizations that do not run CrushFTP, or that upgraded promptly in March 2025 and have since stayed on current builds.

  1. Check the build in CrushFTP.log (Version entry) or the admin UI and upgrade to the current release
  2. Do not stop at 10.8.4/11.3.1: CrushFTP now lists 10.8.5+ and 11.3.4_23+ as minimums after a July 2025 flaw (CVE-2025-54309)
  3. Put the CrushFTP DMZ proxy instance in front of internet-facing servers

Read the brief →

Check exposure

· Vulnerability · CVE-2025-29927

Next.js Middleware Authorization Bypass (CVE-2025-29927)

Patched since March 2025 and easy to fix; if you self-host Next.js and lean on middleware for auth, confirm you are on a fixed release and that the header is stripped at your edge.

Must act: Teams self-hosting Next.js 11.1.4 through 15.2.2 with next start or output: 'standalone' whose middleware enforces authentication, authorization, redirects or security headers.

Can relax: Apps hosted on Vercel, Netlify or Cloudflare Workers, static exports, and apps that do not use middleware for any security decision.

  1. Check the installed version with npm ls next and upgrade to 15.2.3+, 14.2.25+, 13.5.9+ or 12.3.5+ (or any current release).
  2. Strip or reject the x-middleware-subrequest header at your reverse proxy, load balancer, CDN or WAF before traffic reaches the Next.js server.
  3. Move critical authorization checks into route handlers, server actions or the backend so middleware is not the only gate.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)

  • Authorization Bypass in Next.js Middleware CVE-2025-29927 CVSS 9.1 Critical
    next >= 13.0.0, < 13.5.9 → fixed in 13.5.9; next >= 14.0.0, < 14.2.25 → fixed in 14.2.25; next >= 15.0.0, < 15.2.3 → fixed in 15.2.3; +1 more packages

PyPI 1

Check: pip-audit (or: pip show <package>)