Description

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.0",
  "pubDate": "2026-10-12T13:17:33.460Z",
  "pubdate": "2026-10-12T13:17:33.460Z",
  "executiveSummary": "ShareFile Storage Zones Controller versions 5.12.6 and below are susceptible to a critical metadata injection vulnerability originating from improper validation of callback URLs during queue item processing.\nThe vulnerability allows an unauthenticated or low-privileged attacker to influence the FileCopyService by manipulating process flow via a race condition.\nBy coercing the system to acknowledge a malicious callback URL, an attacker can force the application to consume attacker-controlled metadata and arbitrary content, potentially leading to unauthorized file operations or system compromise.\nSuccessful exploitation requires the attacker to exert control over the copy queue work and successfully win a race condition during the callback handshake.\nThis vulnerability presents a significant risk to the integrity of storage zone operations and the underlying infrastructure, as it allows for the manipulation of internal file handling services, bypassing intended security controls associated with file ingestion.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation of callback URLs utilized by the ShareFile Storage Zones Controller during the processing of asynchronous queue items. Specifically, the component responsible for dispatching acknowledgements fails to perform strict origin validation on the callback URI.\nThe FileCopyService component, which handles the movement and synchronization of file data within the storage zones, relies on the processing of these queue items. When the system initiates a file copy operation, it generates a work task that expects a feedback mechanism via a callback. Because the URL is not sufficiently hardened, an attacker can substitute the intended legitimate callback destination with an attacker-controlled endpoint.\nThe exploitation flow is contingent on a race condition. The attacker must inject the malicious callback reference into the work queue and timing-align their response to coincide with the Storage Zones Controller's check against the callback URL. Upon the system querying the provided callback, the attacker-controlled server responds with crafted metadata and content parameters.\nBy manipulating the metadata returned during this handshake, the attacker induces the FileCopyService to interpret malicious directives as legitimate instructions. This metadata is subsequently utilized by the FileCopyService to define the source, destination, or characteristics of the file content being processed. Consequently, the service is manipulated into performing operations that deviate from the expected, secure operational state, allowing for the ingestion of unauthorized data or the overwriting of legitimate storage resources.\nAffected versions include all ShareFile Storage Zones Controller instances running v5.12.6 and below. The vulnerability does not specify a requirement for prior authentication to the application, provided the attacker can reach the endpoint responsible for queue item injection or influence the copy queue work. The exposure is primarily network-dependent, requiring the ability to interact with the controller's internal communication interfaces or the queue management mechanism.\nPost-exploitation, the impact centers on the compromise of the file handling service. By gaining control over the content consumed by FileCopyService, an attacker can achieve unauthorized read/write access to the storage environment, effectively subverting the integrity of the hosted file infrastructure."
}