CVE-2023-2112
📋 TL;DR
This vulnerability in M-Files Desktop component service allows an authenticated user in one session to move laterally to another user's session, potentially accessing unauthorized data or performing actions. It affects M-Files installations before version 23.4.12455.0 where multiple users share the same system.
💻 Affected Systems
- M-Files
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could access sensitive documents, modify permissions, or perform actions in another user's session, leading to data breach or privilege escalation.
Likely Case
Unauthorized access to another user's session data or documents within the same M-Files environment.
If Mitigated
Limited impact with proper session isolation and access controls, though lateral movement risk remains.
🎯 Exploit Status
Requires authenticated access and knowledge of session manipulation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.4.12455.0 and later
Vendor Advisory: https://empower.m-files.com/security-advisories/CVE-2023-2112
Restart Required: Yes
Instructions:
1. Download M-Files version 23.4.12455.0 or later from official sources. 2. Backup current configuration and data. 3. Run installer with administrative privileges. 4. Restart M-Files services and affected systems.
🔧 Temporary Workarounds
Session Isolation
windowsEnsure users run M-Files Desktop in separate user accounts with proper isolation.
Access Restriction
windowsLimit M-Files Desktop access to trusted users only and implement strict access controls.
🧯 If You Can't Patch
- Implement strict user account separation and session management policies.
- Monitor for unusual session activity or lateral movement attempts within M-Files.
🔍 How to Verify
Check if Vulnerable:
Check M-Files version in application settings or via M-Files Admin tool. Versions below 23.4.12455.0 are vulnerable.Check Version:
In M-Files Desktop: Help → About M-FilesVerify Fix Applied:
Confirm version is 23.4.12455.0 or higher and test session isolation between users.📡 Detection & Monitoring
Log Indicators:
- Multiple user sessions accessing same resources, unusual session switching patterns
Network Indicators:
- Unexpected inter-session communication within M-Files service
SIEM Query:
EventID: (M-Files session events) | where UserSession changes without proper authentication