CVE-2021-37447
📋 TL;DR
This vulnerability allows authenticated users in NCH Quorum conference software to delete arbitrary files via directory traversal in the documentdelete endpoint. Attackers can delete critical system files by manipulating the 'file' parameter with '../' sequences. All organizations running NCH Quorum v2.03 or earlier are affected.
💻 Affected Systems
- NCH Quorum
📦 What is this software?
Quorum by Nchsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, leading to system crashes, data loss, or service disruption.
Likely Case
Unauthorized deletion of application files, configuration files, or user documents causing service disruption and data loss.
If Mitigated
Limited impact with proper file permissions and monitoring, potentially only affecting non-critical application files.
🎯 Exploit Status
Exploitation is straightforward with authenticated access. Public proof-of-concept demonstrates the directory traversal technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.04 or later
Vendor Advisory: https://www.nch.com.au/conference/index.html
Restart Required: Yes
Instructions:
1. Download the latest version from NCH website. 2. Backup current configuration and data. 3. Install the update. 4. Restart the Quorum service. 5. Verify the fix by testing the documentdelete endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or middleware to filter '../' sequences in file parameters
Depends on specific WAF or middleware configuration
File Permission Restriction
linuxRun Quorum service with minimal file system permissions to limit damage scope
chmod 750 /path/to/quorum/files
setfacl -m u:quorumuser:rx /path/to/critical
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Quorum servers from critical infrastructure
- Enable detailed logging and monitoring of file deletion operations and implement alerting
🔍 How to Verify
Check if Vulnerable:
Test the documentdelete endpoint with '../' sequences in the file parameter while authenticatedCheck Version:
Check Quorum web interface or configuration files for version informationVerify Fix Applied:
Attempt the same directory traversal attack after patching - it should be blocked or return an error📡 Detection & Monitoring
Log Indicators:
- HTTP requests to documentdelete with '../' in parameters
- Unexpected file deletion events in system logs
Network Indicators:
- HTTP POST/GET requests containing '..' patterns to Quorum endpoints
SIEM Query:
source="web_logs" AND uri="*documentdelete*" AND (param="*../*" OR param="*..\*" OR param="*%2e%2e%2f*")