PT-2024-2196 · Unknown · Filecatalyst Workflow

Tom Wedgbury · Published 2024-03-13 · Updated 2025-09-19 · CVE-2024-25153

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FileCatalyst Workflow versions prior to 5.1.6 Build 114

Description A directory traversal vulnerability within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. This could lead to the execution of arbitrary code, including web shells, if a file is successfully uploaded to the web portal’s DocumentRoot. The issue is related to errors in handling HTTP POST requests. Approximately 97 instances are mainly distributed in the United States, India, and other countries.

Recommendations For versions prior to 5.1.6 Build 114, update to version 5.1.6 Build 114 or later to patch the critical flaw and prevent unauthorized remote code execution. As a temporary workaround, consider restricting access to the ‘ftpservlet’ component until a patch is applied. Additionally, disabling anonymous login for public users in the FileCatalyst Workflow can help minimize the risk of exploitation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-472

CWE-668

Related Identifiers

BDU:2024-02123

CVE-2024-25153

Affected Products

Filecatalyst Workflow

References · 49

• 🔥 https://github.com/nettitude/CVE-2024-25153/blob/master/CVE-2024-25153.py · Exploit
• 🔥 https://github.com/nettitude/CVE-2024-25153 · Exploit
• https://fortra.com/security/advisory/fi-2024-002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02123 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-25153 · Security Note
• https://twitter.com/Dinosn/status/1768132525686165671 · Twitter Post
• https://t.me/s_e_reborn/4596 · Telegram Post
• https://twitter.com/jvquantum/status/1769710934648316187 · Twitter Post
• https://twitter.com/akaclandestine/status/1773281897902211275 · Twitter Post
• https://t.me/ckure/13650 · Telegram Post
• https://twitter.com/kmkz_security/status/1770312092731457691 · Twitter Post
• https://twitter.com/TheRealMikeInOz/status/1769873950035652780 · Twitter Post
• https://t.me/true_secator/5539 · Telegram Post
• https://twitter.com/jbhall56/status/1769699741644795909 · Twitter Post