Executive Summary

This vulnerability involves Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 using hardcoded values in their AES cryptoscheme implementation. This weakens the security of publicly exposed endpoints using this cryptoscheme and may allow arbitrary local file inclusion when a specially crafted unauthenticated request is made. This vulnerability can be combined with previous vulnerabilities to achieve full system compromise.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can degrade the security of public endpoints, potentially allowing attackers to include arbitrary local files without authentication. This can lead to further exploitation, including full system compromise when combined with other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to decrypt or forge access tickets due to hardcoded AES keys, enabling unauthorized access to sensitive files such as web.config, which contains machine keys. This unauthorized access and potential data exposure can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding sensitive information and ensuring data confidentiality and integrity. Organizations affected by this vulnerability may face compliance risks if sensitive personal or health data is exposed or compromised. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by scanning your web server logs for encrypted GET requests to the endpoint /storage/filesvr.dn that include the query parameter "t" containing the string "vghpI7EToZUDIZDdprSubL3mTZ2", which corresponds to the encrypted web.config file path. Monitoring for such requests can indicate exploitation attempts. For example, you can use commands like: - On Linux systems, to search Apache or IIS logs: grep "/storage/filesvr.dn" /path/to/logfile | grep "t=vghpI7EToZUDIZDdprSubL3mTZ2" - Using PowerShell on Windows servers: Select-String -Path "C:\inetpub\logs\LogFiles\*.log" -Pattern "/storage/filesvr.dn.*t=vghpI7EToZUDIZDdprSubL3mTZ2" [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating Gladinet CentreStack and Triofox to version 16.12.10420.56791 or later, which contains the patch for this vulnerability. Additionally, you should rotate the machine keys used by ASP.NET to prevent attackers from leveraging stolen keys for ViewState deserialization attacks. Monitoring for suspicious activity related to this vulnerability and blocking malicious requests targeting /storage/filesvr.dn is also recommended. [1]

Useful 0 Not Useful 0