Truff

A path traversal weakness exists in an optional, non-default administrative feature. This flaw allows an authenticated administrator to move files to unintended locations outside the designated directory, which could potentially lead to arbitrary code execution on the underlying system. Path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder.

A privilege escalation issue exists in clustered deployments where an attacker with existing code execution on one node can execute operating system commands with elevated privileges on another node within the same cluster. This occurs due to insufficient input validation in an internal cluster management function, allowing attacker-supplied values to reach a privileged execution context. The affected function is not accessible from outside the cluster.

A path traversal weakness exists in an administrative import function. This flaw allows an authenticated administrator to write files to arbitrary locations on the server, which could potentially lead to arbitrary code execution on the underlying system. Path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder.

An issue exists that allows an unauthenticated remote attacker to perform Server-Side Request Forgery (SSRF), a technique where the attacker induces the server to make requests to an unintended location. This could enable the attacker to force the server to issue arbitrary outbound network requests and read the responses, potentially granting access to internal-only services or other network-restricted resources.

An authenticated user can store crafted content that executes arbitrary JavaScript in another user's authenticated session during the preview of shared content. This Stored Cross-site Scripting (XSS) issue may result in session compromise and account takeover.

Improper Privilege Management occurs because the software does not correctly enforce restrictions on role assignment. This allows an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges, exceeding the permissions the administrative user was authorized to grant.

An issue exists where the system performs server-side fetches of URLs found within processed message content without sufficient destination restrictions. This allows a remote, unauthenticated sender to craft messages that force the gateway to send requests to internal services and cloud instance metadata endpoints. The system then returns the responses, which can lead to the disclosure of sensitive internal data or alter the state of the reached internal services. This is a Server-Side Request Forgery (SSRF), a flaw where an attacker induces a server-side application to make requests to an unintended location.

An authenticated administrator can achieve Remote Code Execution by importing a configuration with contents that are not sufficiently validated before processing. A crafted submission allows the execution of arbitrary commands on the gateway.

A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially impact service availability. Exploitation requires an authenticated administrative account with access to the reporting function.

An improper restriction of a user-supplied file path in an administrative export feature allows an authenticated administrator to write a file to an arbitrary location on the underlying host. This arbitrary file write could potentially lead to command execution on the appliance. Exploitation requires an authenticated administrative account with access to the affected export function.

A stored cross-site scripting (XSS) weakness allows an authenticated user to submit content that executes arbitrary JavaScript in the session of another user who views that content. This can be used to perform actions on behalf of the victim and may lead to account takeover, including accounts with higher privileges.

A deserialization weakness exists where crafted data can be deserialized unsafely, potentially leading to remote code execution on the appliance. Deserialization is the process of converting a data format (like JSON or XML) back into an object that a program can use. This issue requires an attacker to first influence the affected data to be exploitable.

A privilege escalation issue exists where an attacker with local access and code execution capabilities as an unprivileged backend service account on the appliance can escalate their privileges to root. This allows the attacker to execute arbitrary commands with the highest system privileges.

A privilege escalation issue exists where an attacker with local code execution as an unprivileged backend service account can escalate privileges to root. This occurs because a privileged routine fails to safely handle a filesystem path that the lower-privileged account can influence, enabling the execution of arbitrary commands with root privileges.

A command injection flaw allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Command injection is a security issue where an attacker executes arbitrary commands on a host operating system via a vulnerable application.

Kiteworks Core fails to correctly validate a parameter within the password reset workflow. This allows an unauthenticated attacker who knows the email address of a user with a locally stored password to reset the account password without access to the reset link sent via email. This can lead to full account takeover, including accounts with administrative privileges.

An authenticated administrator can write a file outside its intended location and cause the application to execute it. This flaw may lead to remote code execution with the privileges of the underlying service account.

On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator with access to the key protecting submitted data can redirect the system's outbound support connection to an arbitrary destination. This allows the destination to execute operating-system commands on the node and receive the output, which may lead to remote code execution with the privileges of a local service account.

A local privilege escalation issue exists that could allow an attacker who already has shell access via a low-privileged service account to gain root privileges on the appliance.

A setup interface fails to properly confine user-supplied file paths to the intended directory. This allows an unauthenticated attacker with network access to the interface to write files to any location accessible by the service account, which may compromise the integrity of the appliance or cause a denial of service. Access to this interface is typically limited to the initial provisioning window or occurs in non-default configurations.