Vulnerability found in Workspaces component of Biscom Secure File Transfer

Pixabay | Pexels

A vulnerability has recently been discovered by Orlando Barrera II of Rapid7. The vulnerability is present in the Workspaces component of Biscom Secure File Transfer (SFT) version 5.1.1015. The SFT version is vulnerable to stored cross-site scripting in two fields. An attacker would need to have the ability to create a Workspace and entice a victim to visit the malicious page. This would be done in order to run malicious Javascript in the context of the victim’s browser. Since the victim is necessarily authenticated, this can allow the attacker to perform actions on the Biscom Secure File Transfer instance on the victim’s behalf. After authenticating to the Biscom Secure File Transfer web application, an attacker can alter the “Name” and “Description” fields of a Workspace.

Tod Beardsley, Principle Security Research Manager at Rapid7, has recently commented on the vulnerability:

“While using Biscom’s Secure File Transfer (SFT) product, Rapid7 researcher Orlando Barrera II discovered that a malicious actor could subvert the permissions model of SFT by using cross-site scripting (XSS) techniques. While the attacker would have to already have an account on the specific SFT server, he could ultimately use this technique to spy on file transfers that were otherwise believed to be secure. Today, we’re happy to report that Biscom worked quickly with Rapid7 to ensure that the issue was fixed and their customers were able to get the latest patched version quickly.”

-Tod Beardsley Principle Security Research Manager at Rapid7

As of version 5.1.1025, the issue has been resolved. A web application firewall may also be used to prevent attackers from entering the malicious XSS, and/or protect users by stripping offending XSS.

James Stevenson

Im a Cyber Security enthusiast that loves all things to do with technology. I'm specifically interested in cyber security and ethical hacking.

You may also like...