Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Tungsten Capture (formerly Kofax Capture) allows an unauthenticated attacker to read or write arbitrary files on the server. It can also be used to steal credentials, leading to potential remote code execution or lateral movement within your network.
- Attackers can access it remotely.
- Sensitive credentials may be compromised.
- Server files can be read or modified.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit a deprecated .NET Remoting interface on port 2424 to read or write files on the server or capture credentials. This allows for potential code execution or lateral movement depending on the service account's privileges.
- Accessible over the network.
- Uses a known default endpoint.
- Does not require authentication.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to read or write arbitrary files, disclose credentials, or achieve remote code execution via a deprecated .NET Remoting HTTP channel. While the potential impact is severe, the specific nature of Kofax Capture as an enterprise back-office tool suggests it's less likely to be directly exposed to the public internet. Exploitation would typically require the service to be inadvertently exposed or targeted within a compromised internal network.
- Unauthenticated remote code execution is possible.
- NTLM coercion is a notable attack path.
- Specialized, not widely exposed software.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize actively monitoring for and blocking unauthenticated network requests to port 2424 on Tungsten Capture (Kofax Capture) servers. Given the critical nature and potential for remote code execution or sensitive data disclosure, immediate containment is crucial if exploitation is suspected.
- Block network traffic to port 2424.
- Search logs for suspicious .NET Remoting activity.
- Isolate affected servers from the network.
