Enterprise software maker Micro Focus released security updates for its Filr product last week to patch several critical vulnerabilities discovered by researchers at SEC Consult.
Filr is a file management and collaboration tool that allows enterprise users to access and share corporate files from any device. The product was initially developed by Novell, whose owner, the Attachmate Group, merged with Micro Focus in 2014.
SEC Consult reported on Monday that one of its employees discovered no less than eight serious vulnerabilities affecting Filr versions 1.2 and 2.0. According to the security firm, the flaws can be exploited by an attacker to completely compromise the product.
The list of security holes includes cross-site request forgery (CSRF), command injection, insecure file permission, authentication bypass, path traversal and persistent cross-site scripting (XSS) issues. An attacker can leverage these flaws to alter an appliance’s configuration, execute arbitrary code and commands, and upload arbitrary files.
Researchers also discovered that the HttpOnly flag is not set for session cookies in the web interface. An attacker can leverage this in combination with the persistent XSS vulnerability to steal session cookies.
The following CVE identifiers have been assigned to the vulnerabilities found by SEC Consult: CVE-2016-1607, CVE-2016-1608, CVE-2016-1609, CVE-2016-1610 and CVE-2016-1611. Micro Focus has published separate advisories for each of these weaknesses.
The security holes were reported to the vendor on May 23 and they were addressed last week with the release of Filr 2.0 Security Update 2 and Filr 1.2 Security Update 3. The latest Filr updates also address the Samba vulnerability known as Badlock and an OpenSSL flaw disclosed in May.
While most of the issues discovered by SEC Consult have been patched, there are a couple of bugs that Micro Focus will only patch in upcoming versions. For example, the HttpOnly issue could not be addressed because Micro Focus says a Filr component stops working properly if the flag is set.
The security consulting firm pointed out that these vulnerabilities were identified during a “very quick” security review. Users are advised to update their Filr installations as soon as possible, especially since PoC exploit code has been made available by SEC Consult.
Related: McAfee Application Control Flaws Expose Critical Infrastructure
Related: Reuse of Cryptographic Keys Exposes Millions of IoT Devices