The Template That Read the Disk

An internet-facing CrushFTP 10.6.0 portal at Tideglow Logistics is exploited via CVE-2024-4040. An attacker grabs an anonymous session, abuses the <INCLUDE> template tag to escape the virtual file system sandbox and read /etc/passwd, exfiltrates the serialized session store, lifts a live crushadmin token, and replays it from a second IP to take over the administrator account. Walk the access logs and firewall traffic step by step to trace the injection, the session theft, and the takeover.