Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T13:17:33.313Z",
  "pubdate": "2026-10-12T13:17:33.313Z",
  "executiveSummary": "ShareFile Storage Zones Controller versions 5.12.6 and below are susceptible to a critical vulnerability chain that allows remote, unauthenticated attackers to bypass security controls. The vulnerability arises from improper input validation regarding outbound request destinations, unsafe JSONP formatting, and insufficient queue service authorization.\nBy chaining these flaws, an attacker can perform Server-Side Request Forgery (SSRF) to interact with unintended local handlers and execute unauthorized operations within the queue service. This multi-vector approach grants the attacker the ability to manipulate internal service logic without prior authentication.\nThe risk implications include potential data exfiltration, unauthorized administrative actions, and the compromise of system integrity. Because the vulnerability is exploitable by remote attackers who do not require authentication, the attack surface is significant for any internet-facing instance of the Storage Zones Controller. Remediation is necessary to prevent arbitrary request execution and unauthorized backend task manipulation.",
  "technicalDetails": "The vulnerability in ShareFile Storage Zones Controller v5.12.6 and below manifests as a sophisticated exploit chain involving three distinct security regressions. The root cause lies in the application's failure to enforce strict input validation policies on outbound request parameters and destinations, combined with insecure handling of JSONP responses and inadequate access control for queue management operations.\nThe attack flow begins with the exploitation of the improper validation of outbound request destinations. By injecting malicious parameters into requests intended for the controller, an attacker can coerce the server into acting as a proxy, facilitating Server-Side Request Forgery (SSRF). This allows the attacker to reach internal-only endpoints and local handlers that are typically shielded from the public internet. By interacting with these internal handlers, the attacker gains a foothold to probe and manipulate local service interactions.\nSimultaneously, the presence of unsafe JSONP response formatting enables the attacker to circumvent standard Cross-Origin Resource Sharing (CORS) restrictions. If the application environment or integrated services rely on JSONP for cross-domain data exchange, the attacker can leverage this behavior to receive and extract sensitive data that would otherwise be protected by same-origin policies.\nThe culmination of this chain involves the exploitation of the insufficient validation on the queue service. Once the attacker has successfully utilized SSRF to navigate the internal network boundaries and bypassed local service restrictions, they can issue authenticated-level commands to the queue service. Because the service performs insufficient validation on incoming requests, it processes these unauthorized instructions, allowing the attacker to perform arbitrary queue operations. This may include, but is not limited to, the deletion, modification, or injection of tasks within the internal job queue.\nThis vulnerability is highly severe because it permits unauthenticated remote attackers to move laterally from the external network perimeter into the internal management infrastructure. The exploitation does not require pre-existing privileges, as the lack of robust request validation and authorization checks creates a bypass that is reachable via standard web protocols. The post-exploitation impact allows for the disruption of internal services, potential data manipulation, and the subversion of the controller’s core architectural functions."
}