Fortra has disclosed a vulnerability in their FileCatalyst Workflow product. This vulnerability allows for attackers to write files to arbitrary locations in the filesystem and can lead to arbitrary remote code execution with the privileges of the vulnerable service.
This vulnerability has been assigned CVE-2024-25153 and is considered to be highly critical, with a CVSS score of 9.8.
Note that this vulnerability was reported and fixed in August of 2023, but has only recently been assigned a CVE.
What is the impact?
Successful exploitation of this vulnerability would allow attackers to execute arbitrary code with the privileges of the vulnerable service, potentially leading to complete system compromise.
Are updates or workarounds available?
Fortra has released a fix for this vulnerability and advises all users to upgrade if they have not already done so.
How do I find potentially vulnerable systems with runZero?
From the Service Inventory, use the following query to locate systems running potentially vulnerable software:
html.title:”FileCatalyst”About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.
