PT-2017-18533 · Accellion · Accellion Fta

Paulos Yibelo · Published 2017-05-05 · Updated 2019-10-03 · CVE-2017-8793

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180

Description An issue allows an attacker to bypass the Same Origin Policy by sending a POST request to the "home/seos/courier/web/wmProgressstat.html.php" endpoint with an attacker domain in the acallow parameter, resulting in the device responding with an Access-Control-Allow-Origin header that grants site access to the attacker.

Recommendations For Accellion FTA versions prior to FTA 9 12 180, update to version FTA 9 12 180 or later to resolve the issue. As a temporary workaround, consider restricting access to the "home/seos/courier/web/wmProgressstat.html.php" endpoint to minimize the risk of exploitation. Avoid using the acallow parameter in this endpoint until the issue is resolved.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2017-8793

Affected Products

Accellion Fta

References · 3

• 🔥 https://gist.github.com/anonymous/32e2894fa29176f3f32cb2b2bb7c24cb · Exploit
• https://osv.dev/vulnerability/CVE-2017-8793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8793 · Security Note