what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference
Posted Feb 21, 2016
Authored by Dr. Erlijn van Genuchten | Site syss.de

Thru Managed File Transfer Portal version 9.0.2 suffers from an insecure direct object reference vulnerability that references log data.

tags | exploit
SHA-256 | 2147fd1a7ff3b5ec34b6336e5ee66f68da4bfc155effb2b3a760db009af938d9

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-058
Product: Thru Managed File Transfer Portal
Manufacturer: Thru
Affected Version(s): 9.0.2
Tested Version(s): 9.0.2
Vulnerability Type: Insecure Direct Object Reference (CWE-932)
Risk Level: Medium
Solution Status: Fixed
Manufacturer Notification: 2015-10-28
Solution Date: 2016-01-22
Public Disclosure: 2016-02-15
CVE Reference: Not yet assigned
Author of Advisory: Dr. Erlijn van Genuchten (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Thru Managed File Transfer Portal is a web based file transfer application.
According to the Thru website [1], the application aims to offload large
file transfer to a single platform, to protect files, to replace FTP
servers and to allow access to files anytime, anywhere.

The Thru Managed File Transfer application allows authenticated users to
access log data, which direct access is prevented by the application.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH identified a vulnerability in the functionality to access
log data concerning transactions. Log data can be accessed by
authenticated users by directly accessing the correct URL.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Available log data could be viewed by accessing the URL
https://[HOST]/App/FileSystemLogDetail.aspx?fileSystemLogID=45

By manipulating the parameter "fileSystemLogID", other log data, for
example with fileSystemLogID=4 concerning the /FOLDERS/HOME folder,
could be accessed as well.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The reported security vulnerability has been fixed in a new software
release. Update to the new software version.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-10-26: Vulnerability discovered
2015-10-28: Vulnerability reported to manufacturer
2016-01-22: Manufacturer announced update
2016-02-15: Public release of security advisory
2016-03-02: Public release of revised security advisory (corrected
solution status)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Thru Homepage
http://www.thruinc.com
[2] SySS Security Advisory SYSS-2015-058
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-058.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Dr. Erlijn van Genuchten of the
SySS GmbH.

E-Mail: erlijn.vangenuchten@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Erlijn_vanGenuchten.asc
Key ID: 0xBD96FF2A
Key Fingerprint: 17BB 4CED 755A CBB3 2D47 C563 0CA5 8637 BD96 FF2A

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJW1faGAAoJEAylhje9lv8qMWQQAIXXCeVRlt6x4qne6ae7FlVI
VEN8Wku3OUinPMt25+SQ9uhkvix3kca5gQZyRsfiAf4qT1gNtzEHyikbpHwJDB4n
ZfWlacOqX1GuWWIPlTrrrftm+AJy/jxe+T37+OeX0cKaZFPgJHRP+8+vCkoFypGZ
bON7E6cOME/Urvzd9O4cM/M3ko6Jf6JDejIW7qgqP52hwZsVEvfoYopRb5+B7ilB
g8/kQC9RMjFbiA64jZxn4ze6xLIt44TlcZScNWY3jVxDn6Pr+ImP6gfNHggPWygI
N35Q8s7h4cDLSYPefU/ir6HqNM2PLvBqcYO1PPpYn5wDWMZ7ivZE0SYGqrRBmefr
yrZSfalsoVaLDX31b0wGWsOFO1DLZTPpdsNdXDvrilk6WZZW33kApQm5somL9P3n
jmAjcSYVuHfLRxuYZUO8Ll2aJzEA6mLHaxU6sZpsrKQHVlilv4rkw7PolGNFSsz/
jZzKTfahTIlPBDwtjRdHnXUnj/Roa++KZGgn0tXk8+9SQX13RTMNG3C9VVPaWMjN
LYnSRzKr8IFLwnwzdxOcmcwLaMCKFyydkzutKr1C8Hn5AZjTNwuD5fVCAz2G1GKs
/c7vwrtbW8+w0XiCtGyVjc78kT8xj/3HTBtO5/QXJHw8HsDeoAhBL0LZAIBOyZTH
LkjUtWDeuJdO2SkA3Tv5
=vg0Z
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close