CVE-2024-7694: TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. Remote attackers who already hold administrator privileges on the product platform can upload malicious files that execute arbitrary system commands on the server. The flaw affects a security product intended to counter ransomware, so any successful abuse undermines the platform itself.

How it works

The weakness is categorized as CWE-434. The application does not properly validate the content of uploaded files.

• An attacker with administrator rights on the platform supplies a file whose type is not restricted or inspected.
• The uploaded file can be stored and later invoked to run arbitrary commands on the underlying server.

Am I affected? How to find it in your systems

ThreatSonar Anti-Ransomware is typically deployed on servers or endpoints that require ransomware protection. Begin by locating every installation of the product in your environment.

• Inventory running instances and note any administrative interfaces that accept file uploads.
• Check the versions and configurations present against the details listed in the vendor advisory.
• Review application and system logs for entries that record file uploads performed by administrator accounts or unexpected command execution tied to the product.

How to remediate

Apply mitigations per the vendor instructions as the first action. This addresses the missing file-content validation at the source.

• Install the update supplied by TeamT5 for ThreatSonar Anti-Ransomware.
• Verify that the update has been applied across all instances and confirm the remediation steps match the vendor advisory.

If you can't patch immediately

Follow the CISA directive to apply mitigations per vendor instructions, adhere to applicable BOD 22-01 guidance for any cloud services, or discontinue use of the product if mitigations cannot be obtained.

• Limit administrative access to the platform to the smallest set of accounts required.
• Monitor upload directories and execution logs for unexpected file types or command activity.
• Segment the systems hosting ThreatSonar from broader network resources until the update can be deployed.

If your data may have been exposed

Actively exploited vulnerabilities can lead to breaches. You can run a free exposure scan of your email to check known breach data.