Fortra has addressed a crucial safety flaw impacting FileCatalyst Workflow that may very well be abused by a distant attacker to achieve administrative entry.
The vulnerability, tracked as CVE-2024-6633, carries a CVSS rating of 9.8, and stems from the usage of a static password to connect with a HSQL database.
“The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are printed in a vendor data base article,” Fortra stated in an advisory. “Misuse of those credentials may result in a compromise of confidentiality, integrity, or availability of the software program.”
“The HSQLDB is simply included to facilitate set up, has been deprecated, and isn’t meant for manufacturing use per vendor guides. Nonetheless, customers who haven’t configured FileCatalyst Workflow to make use of another database per suggestions are weak to assault from any supply that may attain the HSQLDB.”
Cybersecurity firm Tenable, which has been credited with discovering and reporting the flaw, stated the HSQLDB is remotely accessible on TCP port 4406 by default, thereby permitting a distant attacker to connect with the database utilizing the static password and carry out malicious operations.
Following accountable disclosure on July 2, 2024, Fortra has launched a patch to plug the safety gap in FileCatalyst Workflow 5.1.7 or later.
“For instance, the attacker can add an admin-level person within the DOCTERA_USERS desk, permitting entry to the Workflow net utility as an admin person,” Tenable stated.
Additionally addressed in model 5.1.7 is a high-severity SQL injection flaw (CVE-2024-6632, CVSS rating: 7.2) that abuses a kind submission step in the course of the setup course of to make unauthorized modifications of the database.
“In the course of the setup technique of FileCatalyst Workflow, the person is prompted to offer firm info by way of a kind submission,” Dynatrace researcher Robin Wyss stated.
“The submitted information is utilized in a database assertion, however the person enter shouldn’t be going by correct enter validation. Because of this, the attacker can modify the question. This permits for unauthorized modifications on the database.”
