Progress Software program has advised ShareFile clients to close down the Home windows servers operating their Storage Zone Controllers, confirming to The Hacker Information that it’s responding to a “credible exterior safety menace.”
The corporate has briefly disabled entry to the affected accounts, a step it says it took “out of an abundance of warning” whereas it really works with inside and exterior safety consultants.
It says it has no indication of unauthorized entry to any ShareFile accounts or knowledge, and that it notified clients after studying of the menace.
What Progress has not stated is what the menace is or who’s behind it.
The order turned public when a buyer posted the corporate’s e mail to Reddit’s r/sysadmin on July 10. Progress confirmed the disruption on its standing web page, itemizing Storage Zone Controller clients as “not operational” and the incident as below investigation as of a 12:12 p.m. EDT replace.
Solely the Storage Zone Controller is affected, not customary cloud-only ShareFile accounts. The controller is a server that an organization runs itself, so information can keep by itself storage whereas it nonetheless makes use of ShareFile’s cloud to share and handle them.
The controller often sits on the community’s edge, reachable from the web. That publicity makes it each helpful and a goal. Ordering clients to take it absolutely offline, somewhat than simply patch it, is a notable step.
That selection is itself a inform. If a repair for this menace existed, Progress can be telling clients to use it; the shutdown order suggests there’s none but. That often means a newly discovered flaw the corporate is racing to shut, although the identical step would additionally match a menace a patch can’t handle, comparable to stolen keys or an issue on Progress’s personal aspect.
Its assertion that no accounts or knowledge had been accessed is cautious wording, too, and doesn’t rule out bother on the controllers themselves.
What to do now
- Comply with the shutdown order first. Preserve the affected controllers offline till Progress says what the menace is and when it’s secure to restart.
- Individually, affirm your model is present: 5.12.4 or afterward the 5.x line, or a 6.x launch. That closes the failings mounted earlier this 12 months, however Progress has not stated it clears the present menace, so don’t deal with it as permission to restart.
- If a controller is reachable from the web, deal with it as a doable incident. Protect the logs and begin your incident-response course of, then examine for unfamiliar .aspx information within the internet folders and storage paths you didn’t set. A clean-looking server isn’t proof that it’s clear.
ShareFile has confronted this earlier than. In 2023, whereas the product nonetheless belonged to Citrix, attackers exploited an unauthenticated flaw in the identical Storage Zones Controller (CVE-2023-24489).
CISA flagged it as actively exploited, and Citrix reduce unpatched controllers off from the ShareFile cloud, the identical entry block Progress has now imposed.
Progress, which acquired ShareFile in 2024, had already weathered a mass file-transfer assault of its personal: MOVEit, whose 2023 zero-day was exploited by the Clop group and hit greater than 2,700 organizations.
The Storage Zones Controller additionally had two vital flaws that watchTowr disclosed in April and Progress patched in March, although the corporate has not related the present menace to them, and neither has been reported as exploited.
The central query remains to be unanswered: Progress has pulled these methods offline and is working with exterior consultants, however has not stated what the menace is or when clients can safely deliver them again on-line.
