Authenticated Administrators Can Read and Write Arbitrary Files via ShareFile Path Traversal Bug

Summary

Progress Software has restored service to customers using ShareFile Storage Zones Controllers following a sudden disruption caused by a zero-day vulnerability. Two days prior to restoration, the company instructed all customers to shut down their servers due to what it described as a "credible external security threat."

While Progress stated it has found no evidence of unauthorized access to customer accounts or data, the company has not yet released specific technical details regarding the nature of the flaw or the full extent of the threat. Access was restored on Tuesday, July 14th, after customers applied newly developed patches.

Technical details

The vulnerability is a path traversal bug that targets authenticated users with administrative privileges. According to private communications sent to customers, the defect allows an attacker with these credentials to perform several high-impact actions:

• Read arbitrary files accessible to the application's service account.
• Write threat actor-controlled content into arbitrary directories.
• Enumerate the layout of the server filesystem.

The flaw affects versions 5.x and 6.x of the ShareFile Storage Zones Controller.

Why this matters for defenders

The severity of the response-instructing customers to disconnect servers from the internet entirely-has raised questions among security researchers regarding the actual risk profile. While Progress describes the bug as requiring administrative privileges, the aggressive mitigation suggests a potential for more significant impact than a standard authenticated path traversal.

Benjamin Harris, founder and CEO of WatchTowr, noted that vulnerabilities assuming existing administrative access do not typically trigger such drastic service shutdowns. This discrepancy suggests there may be additional context or observed activity that has not been publicly disclosed by Progress.

Defender guidance

If you operate ShareFile Storage Zones Controllers, take the following actions:

1. Patch Immediately: Update your controllers to the latest patched versions provided by Progress. Service can only be safely resumed once these updates are applied.
2. Assume Compromise: Because the vulnerability allows for arbitrary file writes and filesystem enumeration, do not assume that a patch alone secures your environment. Investigate your systems for unauthorized changes or suspicious files.
3. Review Administrative Activity: Audit all administrative actions taken on your controllers leading up to the disruption to identify any potential unauthorized movement or configuration changes.

What remains unclear

The specific mechanism of the "credible external security threat" mentioned by Progress remains unknown. It is currently unclear if the company observed active exploitation in the wild, or if the shutdown was a preemptive measure against a suspected attack. Furthermore, the full technical specifics of the path traversal vulnerability have not been released to the public.