Critical RCE Vulnerability in ShareFile: PoC Exploit Available

Recently, a critical vulnerability was discovered in ShareFile, a cloud-based file sharing application. This vulnerability, identified as CVE-2023-24489, enables unauthenticated individuals to perform arbitrary file uploads and execute remote code (RCE).

Critical RCE Vulnerability

CVE-2023-24489, with a CVSS score of 9.8, refers to a cryptographic bug found in ShareFile’s Storage Zones Controller. This controller is a .NET web application operating on IIS.

While investigating ShareFile, the Assetnote researchers concentrated on the .NET web technologies utilized within the application. Their attention was specifically directed towards the .aspx files, which conveniently required no additional effort to access.

Through their analysis of ShareFile, the researchers from Assetnote uncovered a particular endpoint, named “/documentum/upload.aspx,” which was specifically intended for file uploads.

The researchers determined that this endpoint did not have sufficient authentication checks in place, rendering it an appealing target for potential exploitation.

The vulnerability in ShareFile stemmed from mistakes in how it handled cryptographic operations. The application utilized AES encryption with CBC mode and PKCS#7 padding, but it failed to adequately validate decrypted data. This oversight enabled researchers to generate valid padding and carry out their attack.

In .NET, the default padding mode for AES is PKCS#7. In this mode, each added byte indicates the total number of bytes added.

Block ciphers have a limitation where identical blocks encrypt to the same value, which can preserve patterns from the plaintext in the ciphertext. Exploiting this vulnerability can lead to encryption being compromised.

To address this issue, modes of operation like Cipher Block Chaining (CBC) introduce randomness by linking blocks together. In CBC mode, each block is XORed with the previously encrypted block.

Mitigation

Citrix has issued a security update to fix the ShareFile vulnerability. Users are advised to install the update.

Developers should be careful when implementing cryptography to avoid vulnerabilities. Default settings and common practices can introduce risks. To prevent similar problems, developers should consider using encryption modes that offer authentication, such as AES in GCM mode, or adopt the “Encrypt-then-MAC” approach.