Kiteworks vulnerabilities

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate vulnerability to place the file in an executable location.

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance when the notification was next sent.

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file.

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be executed there. Execution was limited to an unprivileged service account on that node.

The sandbox isolating document conversion on a Kiteworks appliance did not fully confine code, potentially allowing escape and execution with the service account's privileges. An attacker could read or modify application data and configuration, or disrupt the service.

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured during initial configuration.

A Kiteworks appliance setup interface did not confine a user-supplied file path, allowing an unauthenticated attacker to write files to arbitrary writable locations. Exploitation requires network access to the interface, which is not reachable on a fully configured appliance by default.

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder.

A privilege escalation vulnerability in Kiteworks could allow an attacker with code execution on one cluster node to run OS commands with elevated privileges on another node. Insufficient input validation in an internal cluster management function allowed attacker-supplied values to reach a privileged context.

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations. This could potentially be leveraged to execute arbitrary code on the underlying system.

A local privilege escalation vulnerability in Kiteworks could allow an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.

On deployments with remote-support enabled, an authenticated System Administrator with the key protecting submitted data could redirect the outbound support connection to a chosen destination. That destination could execute OS commands on the node and receive output, potentially leading to remote code execution.

A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary OS commands as root on the affected node. Successful exploitation requires an administrative account with elevated privileges.

A privilege escalation vulnerability in Kiteworks allows an attacker who already has code execution as an unprivileged backend service account to escalate to root. A privileged routine unsafely handled a filesystem path influenced by the lower-privileged account, allowing arbitrary command execution with highest privileges. Exploitation requires existing local access to that service account.

A privilege escalation vulnerability in Kiteworks allows an attacker who already has code execution as an unprivileged backend service account to escalate to root and run arbitrary commands with highest privileges. Exploitation requires existing local access to that service account.

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective.

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disrupt setup and leave the appliance in an incompletely configured state. The issue is only reachable while an appliance is being activated for the first time and not yet fully configured.

Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms. An authenticated attacker with the FormBuilder role can read and modify other users' form definitions and global configuration parameters.

In Kiteworks prior to version 9.3.0, an IDOR vulnerability was found. An authenticated user can access metadata of other users' resources due to insufficient authorization checks.

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0 allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms, allowing an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has a stored XSS vulnerability in Secure Data Forms, allowing an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership.

Reflected XSS vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. An external attacker can trick a user into executing arbitrary JavaScript code via a crafted link.

Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.

Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms. An authenticated attacker can modify approval flow configurations of other users' forms due to insufficient authorization checks on resource ownership.

Kiteworks prior to version 9.1.0 has improper input validation when managing roles of a shared folder. This could lead to unexpectedly elevating another user's permissions on the share. The issue has been patched in version 9.1.0.