what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference
Posted Feb 22, 2016
Authored by Dr. Erlijn van Genuchten | Site syss.de

Thru Managed File Transfer Portal version 9.0.2 suffers from an insecure direct object reference vulnerability in the contacts list functionality.

tags | exploit
SHA-256 | 04bf2eec97770c7bbdcc28f9522714c4b0542d404957116ca9741cfcd118f04a

Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-064
Product: Thru Managed File Transfer Portal
Manufacturer: Thru
Affected Version(s): 9.0.2
Tested Version(s): 9.0.2
Vulnerability Type: Insecure Direct Object Reference (CWE-932)
Risk Level: Medium
Solution Status: Fixed
Manufacturer Notification: 2015-12-09
Solution Date: 2016-01-22
Public Disclosure: 2016-02-15
CVE Reference: Not yet assigned
Author of Advisory: Dr. Erlijn van Genuchten (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Thru Managed File Transfer Portal is a web based file transfer
application. According to the Thru website [1], the application aims to
offload large file transfer to a single platform, to protect files, to
replace FTP servers and to allow access to files anytime, anywhere.

The Thru Managed File Transfer application allows authenticated users to
access the favourite contacts list of other users.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH identified a vulnerability in the functionality to display
the favourite contacts list. These lists include email addresses of
other users and can be directly accessed using the correct URL.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The favourite contacts lists of different users can be accessed when a
user has a valid user account via the following URL

https://[HOST]/App/asp/list_details.asp?listid=[ID]

Here, merely the numeric parameter "listid" needs to be manipulated.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The reported security vulnerability has been fixed in a new software
release. Update to the new software version.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-12-09: Vulnerability discovered
2015-12-09: Vulnerability reported to manufacturer
2016-01-22: Manufacturer announced update
2016-02-15: Public release of security advisory
2016-03-02: Public release of revised security advisory (corrected
solution status)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Thru Homepage
http://www.thruinc.com
[2] SySS Security Advisory SYSS-2015-064
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-064.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Dr. Erlijn van Genuchten of the
SySS GmbH.

E-Mail: erlijn.vangenuchten@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Erlijn_vanGenuchten.asc
Key ID: 0xBD96FF2A
Key Fingerprint: 17BB 4CED 755A CBB3 2D47 C563 0CA5 8637 BD96 FF2A

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJW1fdBAAoJEAylhje9lv8qeNsP/RaGhK3W8BlLWA7W7Uxo6lA9
lxicKnnHZOg3odR4vSwELsCKvfJ46BDAFC6hS26yqNZTVyjtNsXgc3uCg+RtoWcE
nsUJRUwMKDT3eFjifhRuYBKTyLeK8aARqLo74ZNJ/wySF+ETxTDa2wdEk3Wk6kY7
1rtSEJ0u00fiQJaiCIYd6AYYDqwKPZwxsgaauBp3t53UvIJZ58YtiB7vlUoFdQxO
tG5tvco1a5+XuRLUAK7V4OZvs/ghI/YYU13RSTpGoHX+13Y4MUAPS/kO5lpUVYBF
hsHpZbWnSIU5Xk6MoWpDWZ+XXLvs2/rGg6c4FT4j3837gWwul11V5pDNqJ01C8Yc
1iX04mgBLhcrgZKaJYHWwt/nXiqc+ox5mmpsclmrQMao06qizUdJqnzx5T9NU9Ge
0frRL+jB3q+rhtB6GafomI4kJBFBuxVrKsTvbGkUz7sWkvhCtSB3EINLitFXm2TM
AjZE/IwcU5ODcHAcVP856F9jt0KCH70UYmPb3XByDSGIOWpsCF1E7dlQTQ3aRdym
wijKj8I8bbPrmrUxb/eZhlZxEzfMCxmI5AdAL1IaPvnR8eLx1XTcbAfJGCj262Or
mQUv9Ke7iHATm30byYg/3OlCFIuI7a6xT5sd5TOGwaAjGqMTxYjksP9LKd8PMLc2
mhNWNdVbBztFrlID2fmh
=Xq7K
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close