CVE-2022-1606 In M-Files Server versions before 22.3.11164.0 and 22.3.11237.1, user can read unmanaged objects if privilege assignment is incorrect.
This vulnerability allows users with the "Grant Access" privilege to read any data stored in the M-Files database.
M-Files Server versions 22.3.11164.0 to 22.3.11237.1 have a directory traversal vulnerability that allows users with the "Grant Access" privilege to read any data stored in the M-Files database. This vulnerability is present in the M-Files Server installation process and can be exploited by anyone with access to the M-Files installation directory. This includes the system administrator, who can exploit this vulnerability to gain unauthorized access to the M-Files database.
M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 have a directory traversal vulnerability that allows users with the "Grant Access" privilege to read any data stored in the M-Files database. This vulnerability is present in the M-Files Server installation process and can be exploited by anyone with access to the M-Files installation directory. This includes the system administrator, who can exploit this vulnerability to gain unauthorized access to the M-Files database. M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 have a directory traversal vulnerability that allows users with the "Grant Access" privilege to read any data stored in the M-Files database. This vulnerability is present in the M-Files Server installation process and can be exploited by anyone with
How to exploit the M-Files Server Directory Traversal Vulnerability
To exploit the M-Files Server directory traversal vulnerability and gain access to the M-Files database, an attacker must have access to the installation directory of the M-Files Server.
This can include any user with root privileges on the system on which the M-Files Server is installed or a user with rights to install software in general.
Solution
M-Files has released a security update that fixes this vulnerability. To apply the security update in order to resolve this issue, you must install the M-Files update version 22.3.11237.1 or later.
The M-Files Server installation process can be exploited by anyone with access to the M-Files installation directory, including the system administrator.
This vulnerability will allow users with the "Grant Access" privilege to read any data stored in the M-Files database on vulnerable versions of M-Files Server installed on Windows servers that have been granted local administrative privileges on the target machine. This could include database passwords for user accounts containing sensitive data, such as customer records and credit card information, but not limited to this type of data.
Methods and Strategies to Mitigate Sensitive Data Exposure
The following methods and strategies can be used to mitigate sensitive data exposure in M-Files:
1. M-Files Server versions 22.3.11164.0 to 22.3.11237.1 have a directory traversal vulnerability that allows users with the "Grant Access" privilege to read any data stored in the M-Files database, which is accessible by default because of weak permissions settings on the "/mfiles/data" directory in the M-Files installation directory. You can use the following methods and strategies to mitigate this vulnerability:
a) Specify permissions for directories other than "/mfiles/data" by using the same approach as you would for any other file on an M-Files server:
i) Set appropriate access rights for all files stored in the "/mfiles/data" directory by using Full Control or Read Only privileges:
ii) Protect against unauthorized access to sensitive information by setting restrictive access rights for files in directories other than "/mfiles/data":
b) Avoid storing sensitive data that could be exposed due to this vulnerability:
i) Remove unused data from your system before updating your version of M-Files Server (by deleting files, archiving old data, or transferring it offsite):
ii) Remove unused columns from filters and reports before upgrading your version of M-Files Server (by removing columns from filters or reports before upgrading):
iii) Ensure that compliance requirements are met
Installation of M-Files Server
The vulnerability occurs when the M-Files installer calls a program that might allow attackers to gain unauthorized access to the M-Files database.
M-Files is an open source, cross-platform database management application that is designed for use within Microsoft Windows and Linux environments. The application provides users with a database to store their work and uses SQLite as its storage backend. This software solution has been used in large organizations such as Airbus, Boeing, United Airlines, and Siemens.
Timeline
Published on: 11/30/2022 15:15:00 UTC
Last modified on: 12/02/2022 17:35:00 UTC