Incorrect Access Control in Veno File Manager

Executive Summary

Veno File Manager Project version 4.4.9 has an Incorrect Access Control vulnerability in admin-head-updates.php. An unauthenticated attacker can exploit a Local File Inclusion via the 'lang' GET parameter using a crafted POST request. This corrupts the configuration file, allowing the attacker to reset the superadministrator password to default and gain full admin access without user interaction.

Useful 0 Not Useful 0

Detection Guidance

Check if the vulnerable file admin-head-updates.php exists in your Veno File Manager installation. Look for unusual POST requests with the 'lang' parameter or GET requests to the setup endpoint. Monitor for unauthorized password resets or configuration file changes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full administrative control over the Veno File Manager system. This could lead to unauthorized file access, data theft, system manipulation, or complete takeover of the application and its hosted files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update Veno File Manager to the latest version if available. Remove or restrict access to admin-head-updates.php. Implement strict input validation for the 'lang' parameter. Ensure the setup endpoint is protected and requires authentication.

Useful 0 Not Useful 0