Active attacks exploit Gladinet’s hard-coded keys for unauthorized access and code execution.

On December 2, Huntress’s support team received an email from a Gladinet customer. The customer reported that Gladinet contacted him on November 30, informed him about the new security issue, and asked him to immediately install the latest update that came out on November 29. Additionally, Gladinet also provided them with Indicators of Compromise (IoCs) to detect whether the system was hacked or not.

As of December 10, Huntress discovered that nine different organizations had become victims of this vulnerability. These companies were from healthcare, technology, and other sectors.

Security researcher Brian Masters clearly stated, “Attackers can exploit this bug to gain access to the web.config file. After this, they can perform deserialization and remote code execution.”

Now let’s talk about what the attacker does.

This means that if an attacker gets hold of it, he can easily bypass encryption and validation.

Gladinet released a new update as soon as it received news of the threat and asked customers to install it immediately. Now the advice is – those whose systems are affected should immediately install the new version and change their machineKey to maintain security.

What is filesvr.dn and how does it work?

filesvr.dn is a custom HTTP handler, configured in web.config. It reads a query parameter ‘t’. ‘t’ is actually an access ticket, which is an encrypted string containing four types of information:

The server trusts this ticket and grants file access based on its contents.

When the server starts, it generates encryption keys using a function inside GladCtrl64.dll, using the current time, and stores two 100-byte keys in memory.

To generate these keys, the server uses a process:

The system takes an encrypted ticket, sanitizes it, decrypts it using fixed keys, and gets a simple 4-line statement: what file to access, what user to act as, what password to use, and when the ticket was created.

If the ticket is not older than 4 hours and the username/password is correct, the server acts as that user and accesses the file system on that user’s behalf.

Researchers examined how the server creates its encryption keys.

They found:

The GenerateSecKey function (inside GladCtrl64.dll) always returns the same two 100-byte strings every time the server runs. These strings come from:

Found this article interesting, read more exclusive content we post.