Enterprise software maker Micro Focus released security updates for its Filr product last week to patch several critical vulnerabilities discovered by researchers at SEC Consult.
Filr is a file management and collaboration tool that allows enterprise users to access and share corporate files from any device. The product was initially developed by Novell, whose owner, the Attachmate Group, merged with Micro Focus in 2014.
SEC Consult reported on Monday that one of its employees discovered no less than eight serious vulnerabilities affecting Filr versions 1.2 and 2.0. According to the security firm, the flaws can be exploited by an attacker to completely compromise the product.
The list of security holes includes cross-site request forgery (CSRF), command injection, insecure file permission, authentication bypass, path traversal and persistent cross-site scripting (XSS) issues. An attacker can leverage these flaws to alter an appliance’s configuration, execute arbitrary code and commands, and upload arbitrary files.
Researchers also discovered that the HttpOnly flag is not set for session cookies in the web interface. An attacker can leverage this in combination with the persistent XSS vulnerability to steal session cookies.
The following CVE identifiers have been assigned to the vulnerabilities found by SEC Consult: CVE-2016-1607, CVE-2016-1608, CVE-2016-1609, CVE-2016-1610 and CVE-2016-1611. Micro Focus has published separate advisories for each of these weaknesses.
The security holes were reported to the vendor on May 23 and they were addressed last week with the release of Filr 2.0 Security Update 2 and Filr 1.2 Security Update 3. The latest Filr updates also address the Samba vulnerability known as Badlock and an OpenSSL flaw disclosed in May.
While most of the issues discovered by SEC Consult have been patched, there are a couple of bugs that Micro Focus will only patch in upcoming versions. For example, the HttpOnly issue could not be addressed because Micro Focus says a Filr component stops working properly if the flag is set.
The security consulting firm pointed out that these vulnerabilities were identified during a “very quick” security review. Users are advised to update their Filr installations as soon as possible, especially since PoC exploit code has been made available by SEC Consult.
Related: McAfee Application Control Flaws Expose Critical Infrastructure
Related: Reuse of Cryptographic Keys Exposes Millions of IoT Devices
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
Latest News
- Fraudulent “CryptoRom” Apps Slip Through Apple and Google App Store Review Process
- US Downs Chinese Balloon Off Carolina Coast
- Microsoft: Iran Unit Behind Charlie Hebdo Hack-and-Leak Op
- Feds Say Cyberattack Caused Suicide Helpline’s Outage
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
