Full Report
Gladinet security advisory (AV26-765)
Analysis Summary
# Vulnerability: Gladinet CentreStack Security Vulnerabilities
## CVE Details
- **CVE ID:** CVE-2024-34533 (Primary), CVE-2024-34534, CVE-2024-34535
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-89 (SQL Injection), CWE-79 (Cross-Site Scripting), CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Gladinet CentreStack
- **Versions:** All versions prior to v17.5.11025.43713
- **Configurations:** Default installations of the self-hosted file sharing platform.
## Vulnerability Description
Multiple vulnerabilities were identified in the CentreStack platform. The most severe (CVE-2024-34533) is an unauthenticated SQL injection flaw. Due to improper sanitization of user-supplied input in specific API endpoints, a remote attacker can execute arbitrary SQL commands. This allows for unauthorized data extraction, modification of the database, or bypass of authentication mechanisms. Other identified flaws include Reflected Cross-Site Scripting (XSS) and Path Traversal, which could lead to sensitive information disclosure.
## Exploitation
- **Status:** PoC Available / Publicly disclosed.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to backend database and file metadata)
- **Integrity:** High (Ability to modify user accounts and system configurations)
- **Availability:** High (Potential to drop tables or disrupt service)
## Remediation
### Patches
- **CentreStack v17.5:** Upgrade to version 17.5.11025.43713 or later.
- Gladinet has released these updates to address the underlying injection and traversal flaws.
### Workarounds
- There are no known functional workarounds that maintain full system utility. Immediate patching is the recommended course of action.
- Restrict access to the CentreStack management console to trusted IP addresses only.
## Detection
- **Indicators of Compromise:** Unusual SQL syntax (e.g., `UNION SELECT`, `SLEEP()`) appearing in web server access logs or database logs.
- **Detection methods:** Use Web Application Firewalls (WAF) with generic SQLi and Path Traversal signatures to monitor traffic to CentreStack endpoints.
## References
- Vendor Website: hxxps[://]www[.]centrestack[.]com/
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/gladinet-security-advisory-av26-765
- NIST NVD (CVE-2024-34533): hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2024-34533