Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability in FileRise's file upload functionality allows unauthenticated attackers with a shared link to gain administrator access, potentially leading to system compromise. This issue arises from improper handling of file paths during uploads, enabling attackers to write files to arbitrary locations.
- File uploads can be hijacked to take over accounts.
- Consider the exposure of shared file upload features.
- Confirm if shared file upload is a relevant service.
Attack Path
How an attacker could exploit the issue
An attacker with a valid, non-expired, upload-enabled shared-folder link or token can exploit a path traversal vulnerability in FileRise to write arbitrary files. This could lead to administrator account takeover and potentially remote code execution, as the filename validation does not adequately prevent traversal sequences when URL-encoded, and the destination path is not properly checked before a file is moved.
- Requires a shared upload link or token.
- Triggers with a specially crafted, URL-encoded filename.
- Results in account takeover and code execution.
Live Threat
Current exploitation, exposure, and threat context
FileRise before version 3.16.0 suffers from a path traversal vulnerability in its shared-folder upload endpoint. This vulnerability could allow an attacker with a valid, non-expired upload-enabled shared-folder link or token to overwrite critical files, such as `users/users.txt`, to create an administrator account. This could lead to an unauthenticated administrator takeover of the system and, depending on the configuration, potentially remote code execution. The vulnerability is exploitable when an attacker possesses a valid shared-folder link/token with upload permissions.
- Sensitive user and configuration files.
- Path traversal via crafted filenames.
- Account takeover and potential RCE.
Operational Fix
Recommended remediation, mitigation, and detection steps
The FileRise shared-folder upload endpoint is vulnerable to path traversal, enabling arbitrary file writes and administrator account takeover by attackers who possess a valid upload-enabled shared-folder link. The initial action is to identify all instances of FileRise, confirm their exposure and criticality, and identify the accountable owner for remediation planning.
- Identify FileRise instances and exposure.
- Verify shared folder link access and permissions.
- Plan remediation with vendor coordination.
