Threat of CSRF
|Security Advisory Date
|January 6, 2022
|Cross-site Request Forgery (CSRF)
Medium, since this only occurs in browsers where cookies have samesite set to None
|All versions of FileCloud prior to 21.3
|FileCloud Version 126.96.36.19947
|Tim Wörner and Gerbert Roitburd of usd AG
This vulnerability enables an attacker to forge a request that, if executed by an administrator, submits a request that uploads a csv file containing information that FileCloud uses to create a new user. The attacker can then log in to FileCloud with the new user credentials. This only occurs if cookies have samesite set to None.
This has been fixed in FileCloud version 188.8.131.5247, which includes additional CSRF checks for uploads
What you should do
- If you are using FileCloud on-premises, it is recommended that you update to the latest version, which is 184.108.40.20647 or greater. This will resolve the issue.
- If you are using FileCloud online, your site has already been updated to the latest version.
If you have any questions about this advisory, please contact FileCloud support.