PT-2017-18533 · Accellion · Accellion Fta

Paulos Yibelo · Publicado 2017-05-05 · Atualizado 2019-10-03 · CVE-2017-8793

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180

Description An issue allows an attacker to bypass the Same Origin Policy by sending a POST request to the "home/seos/courier/web/wmProgressstat.html.php" endpoint with an attacker domain in the acallow parameter, resulting in the device responding with an Access-Control-Allow-Origin header that grants site access to the attacker.

Recommendations For Accellion FTA versions prior to FTA 9 12 180, update to version FTA 9 12 180 or later to resolve the issue. As a temporary workaround, consider restricting access to the "home/seos/courier/web/wmProgressstat.html.php" endpoint to minimize the risk of exploitation. Avoid using the acallow parameter in this endpoint until the issue is resolved.

Exploit

Correção

Origin Validation Error

Enumeração de Fraquezas

CWE-346

Identificadores relacionados

CVE-2017-8793

Produtos afetados

Accellion Fta

Referências · 3

• 🔥 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb · Exploit
• https://osv.dev/vulnerability/CVE-2017-8793 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8793 · Nota de Segurança