Critical Vulnerability in Fortra FileCatalyst Workflow: CVE-2024-5276

A significant security flaw has been uncovered in Fortra FileCatalyst Workflow, a widely-used web-based file exchange and sharing platform. This vulnerability, identified as CVE-2024-5276, presents a serious threat, earning a CVSS v3.1 score of 9.8 out of 10, indicating its critical nature. Discovered by researchers at Tenable on May 15, 2024, and disclosed publicly on June 26, 2024, this SQL injection vulnerability can potentially allow remote, unauthenticated attackers to create rogue administrative users and manipulate data within the application database.

Understanding the Vulnerability

FileCatalyst Workflow is designed to facilitate the exchange and sharing of large files, supporting organizations around the globe in accelerating data transfers and enabling collaboration within private cloud environments. However, the identified vulnerability threatens the security of these operations. According to Fortra’s security bulletin, the flaw allows for the creation of administrative users and the modification or deletion of data within the application database. However, Fortra clarifies that data exfiltration is not possible via this specific vulnerability.

The vulnerability affects FileCatalyst Workflow versions 5.1.6 Build 135 and earlier. Fortra has released a patch in version 5.1.6 Build 139, urging users to update their systems to this version to mitigate the risk.

The Mechanics of the Exploit

The SQL injection vulnerability lies in the ‘jobID’ parameter used within various URL endpoints of the Workflow web application. The ‘findJob’ method employs a user-supplied ‘jobID’ to construct the ‘WHERE’ clause in an SQL query. However, this parameter is not properly sanitized, allowing an attacker to inject malicious SQL code.

Tenable, the cybersecurity firm that discovered the vulnerability, provided a proof-of-concept (PoC) exploit. Their script demonstrates how an anonymous remote attacker can leverage the ‘jobID’ parameter to insert a new administrative user (‘operator’) with a predetermined password (‘password123’). The script then retrieves the login token and uses the newly created credentials to access the vulnerable endpoint, illustrating the ease with which an attacker can exploit this flaw.

Mitigation and Workarounds

For users unable to immediately apply the patch, Fortra recommends disabling certain servlets as a temporary workaround. Specifically, disabling the ‘csv_servlet’, ‘pdf_servlet’, ‘xml_servlet’, and ‘json_servlet’ in the ‘web.xml’ file located in the Apache Tomcat installation directory can help mitigate the risk. However, the best course of action remains updating to the patched version, 5.1.6 Build 139.

Broader Implications and Context

The disclosure of CVE-2024-5276 highlights the ongoing challenges in maintaining the security of web-based applications, especially those handling sensitive data transfers. This incident is reminiscent of a similar security breach in early 2023 when the Clop ransomware gang exploited a zero-day vulnerability in Fortra’s GoAnywhere MFT, tracked as CVE-2023-0669. This earlier incident involved data theft attacks and blackmail attempts against hundreds of organizations, underlining the potential severity of such vulnerabilities.