Pierluigi Paganini
August 30, 2024
Cybersecurity and automation company Fortra released patches for two vulnerabilities in FileCatalyst Workflow. Once of the vulnerabilities is a critical issue, tracked as CVE-2024-6633 (CVSS score of 9.8) described as Insecure Default in FileCatalyst Workflow Setup.
The flaw impacts FileCatalyst Workflow 5.1.6 Build 139 and earlier.
The attack on FileCatalyst Workflow requires specific conditions: the software must be configured with the bundled HSQL database (against recommendations), be accessible to the attacker, who is already inside the corporate network and performing port scanning, or have its HSQLDB port exposed to the internet.
This vulnerability allows an unauthenticated attacker to gain remote access to the database, potentially manipulating or exfiltrating data and creating admin users, though their access remains sandboxed.
The root cause of the problem is the default credentials for the setup HSQL database (HSQLDB) that were disclosed by the vendor in a knowledgebase article.
The company explains that HSQLDB, which is deprecated, is included in FileCatalyst Workflow with the only purpose of simplify installation. However, if no alternative database is configured, using HSQLDB can expose FileCatalyst Workflow instances to hackers.
“The attack grants an unauthenticated attacker remote access to the database, up to and including data manipulation/exfiltration from the database, and admin user creation, though their access levels are still sandboxed.” reads the advisory.
The second flaw addressed by the company is a high-severity SQL injection issue tracked as CVE-2024-6632. The attack on FileCatalyst Workflow requires super admin credentials to access the UI screen with the vulnerable field (phone number). However, since there is only one super admin, if an attacker compromises these credentials, they would have no need for the SQL injection as they would already possess far more dangerous privileges.
“A vulnerability exists in FileCatalyst Workflow whereby a field accessible to the super admin can be used to perform an SQL injection attack which can lead to a loss of confidentiality, integrity, and availability,” reads the advisory.
Fortra recommends customers to update to FileCatalyst Workflow version 5.1.7 build 156 or later.
It’s unclear if the vulnerabilities are actively exploited in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SQLinjection)
