eFileCabinet Authentication Bypass
Title
-----
eFileCabinet Authentication Bypass
Severity
--------
Medium
Date Discovered
---------------
12/20/2006
Vendor Notified
---------------
3/26/2007
Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
- sxkeebler
Vulnerability Description
-------------------------
The eFileCabinet software suite is used to house digital images of files.
Though the eFileCabinet HTTP interface is password protected, it is possible to
bypass said access controls to gain partial access to the eFileCabinet
software. In order to bypass security, an attacker must supply a non-existent
filecabinetnumber, such as 0. An attacker can utilize this access to partially
navigate the eFileCabinet HTTP interface. Successful exploitation of this flaw
could allow an attacker to create efileCabinet drawers or to potentially obtain
access to sensitive information.
Solution Description
--------------------
The vendor has been notified of this flaw but has not provided a patch. For
more information concerning the eFileCabinet Authentication Bypass flaw, please
contact eFileCabinet.
Tested Systems / Software (with versions)
-----------------------------------------
Confirmed on Version 3.3. Other versions may be vulnerable.
Vendor Name
-----------
EFileCabinet
Vendor Website
-------
http://www.efilecabinet.com/