bugtraq - [SYSS-2015-064] Thru Managed File Transfer Portal 9.0.2 - Insecure Direct Object Reference (CWE-932)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 19 Feb 2016 12:59:42 GMT
From: erlijn.vangenuchten@...s.de
To: bugtraq@...urityfocus.com
Subject: [SYSS-2015-064] Thru Managed File Transfer Portal 9.0.2 -
 Insecure Direct Object Reference (CWE-932)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-064
Product: Thru Managed File Transfer Portal 
Manufacturer: Thru
Affected Version(s): 9.0.2
Tested Version(s): 9.0.2
Vulnerability Type: Insecure Direct Object Reference (CWE-932)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2015-12-09
Solution Date: 2016-01-22
Public Disclosure: 2016-02-15
CVE Reference: Not yet assigned
Author of Advisory: Dr. Erlijn van Genuchten (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

Thru Managed File Transfer Portal is a web based file transfer
application. According to the Thru website [1], the application aims to
offload large file transfer to a single platform, to protect files, to
replace FTP servers and to allow access to files anytime, anywhere.

The Thru Managed File Transfer application allows authenticated users to 
access the favourite contacts list of other users.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH identified a vulnerability in the functionality to display 
the favourite contacts list. These lists include email addresses of
other users and can be directly accessed using the correct URL.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

The favourite contacts lists of different users can be accessed when a 
user has a valid user account via the following URL

https://[HOST]/App/asp/list_details.asp?listid=[ID] 

Here, merely the numeric parameter "listid" needs to be manipulated.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The reported security vulnerability has been fixed in a new software
release. Update to the new software version.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-12-09: Vulnerability discovered
2015-12-09: Vulnerability reported to manufacturer
2016-01-22: Manufacturer announced update
2016-02-15: Public release of security advisory

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Thru Homepage
    http://www.thruinc.com
[2] SySS Security Advisory SYSS-2015-064
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-064.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Dr. Erlijn van Genuchten of the
SySS GmbH.

E-Mail: erlijn.vangenuchten@...s.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Erlijn_vanGenuchten.asc
Key ID: 0xBD96FF2A
Key Fingerprint: 17BB 4CED 755A CBB3 2D47 C563 0CA5 8637 BD96 FF2A

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of  this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWwbeJAAoJEAylhje9lv8qrtsP/2WwR4gbSY5C7Xwynt5LaTY+
TN38LpHGD4TwP6mS9gk0OIzHJmywUrSAQvbnEI0gC1kiOdFyUwOdaB2Q9JlVyx4a
lT9ErbTEtj0xu923tVKXdj+uKtgH+ZzdoMzbUVWMxkNC5kKCCxOfyYJfFIbcBRxE
AFseXLax53dJTujF1iQQnGGUWpeRCyVyW3MA0EjsEZ2eXZGd/q+dh89I/Onifk3o
VtWpmhx62d88xJ4xOwL9kPB/+5xDXiXAvnGl34lc7SApC+EzAs5bbAfpQmqtzWj5
MopK90uxDl9W1XXtFR3f9By6o63jvOIbt0TqhszZPR6YEpsNfbbApsLxFNVNrGRU
E1Mc+ELd8s/g1tf3NCgxKXjSwebpzhvHZDhgJ3DWaFdJLzqu2gw504omOfPaHDBj
x3whtIeEAJxiIaRJ415T021bR6Cfut32dE6Mw8ybgf9YiuLBBYIpMAU1QwZIT3k9
q4lQAb7wiIrbZTvuFcI/hI2tTvzXE2gwVm3jxCC05tHwiCfujfx5ZsIXdj6Qe0XD
HooUKSqncu1LUoFsUbFZIWcizl+BM4GizIlpw6fpH1xGKpqRG7W9Zdq3+46P5CYm
LrcmrhQdig3o6OqoIiZ2HxQRL0CXvc/vae/ecBS/v5Bm3PlELOnR8Y/Kcya22xsV
CMFFSHtW1e51DoOn9UVm
=iDC3
-----END PGP SIGNATURE-----