Gladinet CentreStack Flaw Exploited to Hack Organizations

SecurityWeek reports that Huntress warns of attacks on Gladinet CentreStack instances, with nine organisations affected as of 10 December, across sectors from healthcare to technology. The exploitation targets an insecure cryptography flaw in CentreStack’s mobile access and secure sharing solution, enabling access to the web.config file and its machineKey.

Attackers could use the two 100-byte strings that CentreStack relies on to derive cryptographic keys to decrypt tickets or forge new ones, potentially enabling remote code execution via ViewState deserialization. The piece notes that no CVE identifier has been published for the flaw and that Gladinet has not disclosed details, but a CentreStack update (version 16.11.10417.56762) was released in late November, with a further update to CentreStack and Triofox (version 16.12.10420.56791) issued on 10 December. Organisations are advised to update to the latest versions and review Huntress’s and Gladinet’s indicators of compromise.