{"uuid": "584fc28a-6d8a-4350-a78f-53a7d079f6a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-24489", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/180", "content": "Encrypted Doesn't Mean Authenticated: ShareFile RCE (CVE-2023-24489)\n\n\ud83d\udc64 by Dylan Pindur\n\nShareFile is cloud-based file sharing and collaboration application. The software providing this feature is a .NET web application running under IIS called \"Storage Zones Controller\" (also sometimes called Storage Center) and this is what Assetnote team decided to target.\nThrough their research they were able to achieve unauthenticated arbitrary file upload and full remote code execution by exploiting a seemingly innocuous cryptographic bug. Citrix has released a security update and assigned this issue CVE-2023-24489.\n\n\ud83d\udcdd Contents:\n\u25cf Introduction\n\u25cf Where to Start?\n\u25cf Authenticated, but Not Really\n\u25cf A Simple Path Traversal\n\u25cf Encryption != Authentication\n\u25cf Block Ciphers and Padding\n\u25cf Cipher Block Chaining\n\u25cf Enough Cryptography, Show Me the Exploit\n\u25cf What Have We Learned?\n\u25cf Conclusions\n\nhttps://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/", "creation_timestamp": "2023-07-11T04:59:28.000000Z"}