CVE-2022-25241
📋 TL;DR
This CSRF vulnerability in FileCloud's CSV user import functionality allows attackers to trick authenticated administrators into unknowingly creating new user accounts. Attackers can exploit this to create unauthorized accounts with administrative privileges. All FileCloud instances running versions before 21.3 are affected.
💻 Affected Systems
- FileCloud
📦 What is this software?
Filecloud by Filecloud
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, gaining full control over the FileCloud instance, accessing all files, and potentially pivoting to internal networks.
Likely Case
Attackers create standard user accounts to access sensitive files, exfiltrate data, or maintain persistence in the environment.
If Mitigated
With proper CSRF protections and user awareness, exploitation attempts fail or are detected before causing damage.
🎯 Exploit Status
Exploitation requires tricking an authenticated administrator into visiting a malicious webpage. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.3 and later
Vendor Advisory: https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation
Restart Required: Yes
Instructions:
1. Backup your FileCloud instance. 2. Download FileCloud version 21.3 or later from the official vendor portal. 3. Follow the vendor's upgrade documentation. 4. Restart the FileCloud service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Disable CSV User Import
allTemporarily disable the vulnerable CSV user import functionality in FileCloud administration settings.
Implement CSRF Tokens
allManually add CSRF tokens to the CSV user import form if custom modifications are possible.
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions.
- Use web application firewalls (WAF) to detect and block CSRF attempts targeting the CSV import endpoint.
🔍 How to Verify
Check if Vulnerable:
Check the FileCloud version in the admin panel. If version is below 21.3, the system is vulnerable.Check Version:
Check the admin dashboard or run: grep -i version /path/to/filecloud/installation/config/filesVerify Fix Applied:
After upgrading to 21.3 or later, verify that CSRF tokens are now required for CSV user import requests.📡 Detection & Monitoring
Log Indicators:
- Multiple user creation events from same IP in short time
- User creation via CSV import without corresponding admin login
Network Indicators:
- POST requests to /admin/users/import-csv without Referer header or CSRF token
SIEM Query:
source="filecloud" AND (event="user_created" OR uri_path="/admin/users/import-csv") | stats count by src_ip, user🔗 References
- http://packetstormsecurity.com/files/166074/FileCloud-21.2-Cross-Site-Request-Forgery.html
- https://herolab.usd.de/security-advisories/
- https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation
- http://packetstormsecurity.com/files/166074/FileCloud-21.2-Cross-Site-Request-Forgery.html
- https://herolab.usd.de/security-advisories/
- https://www.filecloud.com/supportdocs/display/cloud/Advisory+2022-01-3+Threat+of+CSRF+via+User+Creation
