Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Critical Flaws Found in Enterprise File Sharing Tool Filr

Enterprise software maker Micro Focus released security updates for its Filr product last week to patch several critical vulnerabilities discovered by researchers at SEC Consult.

Enterprise software maker Micro Focus released security updates for its Filr product last week to patch several critical vulnerabilities discovered by researchers at SEC Consult.

Filr is a file management and collaboration tool that allows enterprise users to access and share corporate files from any device. The product was initially developed by Novell, whose owner, the Attachmate Group, merged with Micro Focus in 2014.

SEC Consult reported on Monday that one of its employees discovered no less than eight serious vulnerabilities affecting Filr versions 1.2 and 2.0. According to the security firm, the flaws can be exploited by an attacker to completely compromise the product.

The list of security holes includes cross-site request forgery (CSRF), command injection, insecure file permission, authentication bypass, path traversal and persistent cross-site scripting (XSS) issues. An attacker can leverage these flaws to alter an appliance’s configuration, execute arbitrary code and commands, and upload arbitrary files.

Researchers also discovered that the HttpOnly flag is not set for session cookies in the web interface. An attacker can leverage this in combination with the persistent XSS vulnerability to steal session cookies.

The following CVE identifiers have been assigned to the vulnerabilities found by SEC Consult: CVE-2016-1607, CVE-2016-1608, CVE-2016-1609, CVE-2016-1610 and CVE-2016-1611. Micro Focus has published separate advisories for each of these weaknesses.

The security holes were reported to the vendor on May 23 and they were addressed last week with the release of Filr 2.0 Security Update 2 and Filr 1.2 Security Update 3. The latest Filr updates also address the Samba vulnerability known as Badlock and an OpenSSL flaw disclosed in May.

While most of the issues discovered by SEC Consult have been patched, there are a couple of bugs that Micro Focus will only patch in upcoming versions. For example, the HttpOnly issue could not be addressed because Micro Focus says a Filr component stops working properly if the flag is set.

The security consulting firm pointed out that these vulnerabilities were identified during a “very quick” security review. Users are advised to update their Filr installations as soon as possible, especially since PoC exploit code has been made available by SEC Consult.

Related: McAfee Application Control Flaws Expose Critical Infrastructure

Related: Reuse of Cryptographic Keys Exposes Millions of IoT Devices

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.