Fortra Resolves High-Risk FileCatalyst Workflow Security Vulnerability with Patch

Aug 28, 2024Ravie LakshmananVulnerability / Data Security

A critical security vulnerability in FileCatalyst Workflow that allowed a remote attacker to obtain administrative access has been fixed by Fortra.

Known as CVE-2024-6633, the flaw has a CVSS score of 9.8 and arises from the utilization of a fixed password for connecting to an HSQL database.

Fortra stated in an advisory that “The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are detailed in a vendor knowledge base article.” Misuse of these credentials could result in a breach of confidentiality, integrity, or availability of the software.

Fortra clarified that “The HSQLDB is provided solely for installation purposes, has been deprecated, and is not meant for production usage as per vendor guidelines. Nevertheless, users who have not configured FileCatalyst Workflow to use an alternative database as per recommendations are susceptible to attacks from any source with access to the HSQLDB.”

Tenable, a cybersecurity firm credited with discovering and reporting the vulnerability, noted that the HSQLDB is accessible remotely by default on TCP port 4406, enabling a remote attacker to connect to the database with the static password and execute malicious activities.

Following a responsible disclosure on July 2, 2024, Fortra has issued a patch to address the security vulnerability in FileCatalyst Workflow version 5.1.7 or higher.

Tenable mentioned, “An attacker can create an admin-level user in the DOCTERA_USERS table, granting admin access to the Workflow web application.”

Version 5.1.7 also resolves a significant SQL injection flaw (CVE-2024-6632, CVSS score: 7.2) that exploits a form submission phase during setup to make unauthorized database changes.

According to Dynatrace researcher Robin Wyss, “In the setup process of FileCatalyst Workflow, users are asked to provide company data via a form submission.” He further explained that “The data submitted is included in a database query but lacks proper input validation, allowing attackers to manipulate the query, leading to unauthorized changes in the database.”