Jonathan Bouman discovered a server-side template injection vulnerability that allows non-authenticated users to retrieve credentials configured on the server. This security flaw poses a significant risk as it could potentially expose sensitive information and compromise the integrity of your FileSender deployment. Immediate action is required!
To release new FileSender versions with rather major changes, it is vitally important to conduct full-system security audits. FileSender always asks an external organisation to perform an audit (blackbox, whitebox, sourcecode audit) before releasing it as stable. This contributes to identifying and addressing any potential vulnerabilities, and maintaining the highest security standards for users.
In addition to the external audit, we enlisted the expertise of a highly skilled security researcher Jonathan Bouman to review the system during a comprehensive security audit of the upcoming FileSender 3.0 release. A high-severity vulnerability was identified in FileSender versions below 2.49 and 3.x beta. This vulnerability was classified under CVE-2024-45186.
This is the FileSender’s first CVE and we are keen to ensure that everyone from the FileSender deployer community is informed.
CVE details
- CVE Identifier: CVE-2024-45186
- Severity Rating: 7.9 (High)
- Affected Versions: FileSender below 2.49 and 3.x beta
- Discovered By: Jonathan Bouman
- Issue Type: Server-Side Template Injection
- Impact: Allows non-authenticated users to retrieve server credentials
- Urgency: High – Upgrade recommended
To mitigate this risk, we strongly urge all FileSender users to upgrade to version 2.49 or the latest 3.x release candidate as soon as possible. While the vulnerability has been rated at 7.9, indicating it isn’t critical for all installations, addressing the issue to protect your systems and data from potential exploitation is still essential.
Special note for S3 storage back-end users
Organisations utilising FileSender with an S3 storage back-end are particularly vulnerable and must prioritise this upgrade. The severity of this vulnerability means that prompt action is necessary to prevent unauthorised access and potential data breaches.
To upgrade to the latest secure version of FileSender, please download it from our releases page on GitHub and follow the provided instructions. Your prompt action is essential in safeguarding your data and maintaining the integrity of your FileSender deployment.
