Resource consumption vulnerability in Cerberus FTP Enterprise
Cerberus FTP Enterprise, versión 8.0.10.3.
INCIBE has coordinated the publication of a high severity vulnerability affecting Cerberus FTP Enterprise, a software solution that provides advanced transfer automation and access flexibility through file retention policies, event support, detailed reporting tools, ad hoc file sharing and the HTTP/S web client, in its version 8.0.10.3, which has been discovered by Rafael Pedrero.
This vulnerability has been assigned the following code, CVSS v3.1 base score, CVSS vector and CWE vulnerability type:
- CVE-2024-5052: 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CWE-400.
This vulnerability has been resolved by Cerberus in version 12.11.6, released on 02/17/2023. To ensure the security and uninterrupted operation of the Cerberus FTP server, the manufacturer recommends the following mitigation measures:
- Update to the latest supported version: Customers are recommended to always update to the latest supported version of the Cerberus FTP server. This ensures access to the latest security enhancements and features, along with protection against known vulnerabilities.
- Secure access to SOAP port 10001:
- Customers can protect access to SOAP port 10001 using Cerberus configuration settings. It is recommended to configure access restrictions and authentication settings to limit access to authorized users.
- In addition, the use of external firewall rules to restrict access to SOAP port 10001 is advised. It is recommended that clients whitelist only trusted IPs with access to this port.
- Enable remote SOAP access if necessary: It is recommended that customers enable the "Allow Remote SOAP Access" feature only when necessary for legitimate SOAP clients. This practice minimizes the attack surface and reduces the risk of unauthorized access.
CVE-2024-5052: Denial of Service (DoS) vulnerability for Cerberus Enterprise 8.0.10.3 web administration. The vulnerability exists when the web server, default port 10001, attempts to process a large number of incomplete HTTP requests.
