CVE-2021-41810
📋 TL;DR
This vulnerability allows stored script injection in M-Files Admin versions before 22.2.11051.0. An authenticated vault administrator can store malicious scripts in configuration data that may be executed by other administrators. Only affects users with vault admin privileges and cannot be exploited remotely.
💻 Affected Systems
- M-Files Admin
📦 What is this software?
Server by M Files
⚠️ Risk & Real-World Impact
Worst Case
A malicious vault administrator could inject scripts that compromise the admin tool, potentially leading to privilege escalation, data theft, or further system compromise within the vault environment.
Likely Case
An authenticated malicious vault administrator could execute arbitrary scripts within the admin tool, potentially modifying vault configurations, accessing sensitive data, or disrupting operations.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized vault administrators only, reducing risk to data integrity within the vault.
🎯 Exploit Status
Exploitation requires vault administrator credentials and access to the M-Files Admin tool.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 22.2.11051.0 and later
Vendor Advisory: https://empower.m-files.com/security-advisories/CVE-2021-41810
Restart Required: Yes
Instructions:
1. Download M-Files Admin version 22.2.11051.0 or later from official M-Files sources. 2. Install the update following vendor instructions. 3. Restart the M-Files Admin tool and verify the version.
🔧 Temporary Workarounds
Restrict Vault Administrator Access
allLimit the number of users with vault administrator privileges to only those who absolutely need it.
Monitor Configuration Changes
allImplement logging and monitoring for configuration changes made through the M-Files Admin tool.
🧯 If You Can't Patch
- Implement strict access controls to limit vault administrator accounts to trusted personnel only.
- Enable detailed logging of all configuration changes and script executions within the M-Files Admin tool.
🔍 How to Verify
Check if Vulnerable:
Check the M-Files Admin version in the application's About dialog or settings. If version is below 22.2.11051.0, the system is vulnerable.Check Version:
Check via M-Files Admin interface: Help > About M-Files AdminVerify Fix Applied:
Verify the M-Files Admin version is 22.2.11051.0 or higher after applying the update.📡 Detection & Monitoring
Log Indicators:
- Unusual configuration changes in M-Files Admin logs
- Script execution events in admin tool logs
- Multiple failed authentication attempts followed by successful vault admin login
Network Indicators:
- None - this is not a network-based vulnerability
SIEM Query:
Search for events where user with vault admin privileges makes configuration changes containing script-like patterns in M-Files logs.