Thru Managed File Transfer Portal 9.0.2 Insecure Direct Object Reference

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2015-064  
Product: Thru Managed File Transfer Portal   
Manufacturer: Thru  
Affected Version(s): 9.0.2  
Tested Version(s): 9.0.2  
Vulnerability Type: Insecure Direct Object Reference (CWE-932)  
Risk Level: Medium  
Solution Status: Fixed  
Manufacturer Notification: 2015-12-09  
Solution Date: 2016-01-22  
Public Disclosure: 2016-02-15  
CVE Reference: Not yet assigned  
Author of Advisory: Dr. Erlijn van Genuchten (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
Thru Managed File Transfer Portal is a web based file transfer  
application. According to the Thru website [1], the application aims to  
offload large file transfer to a single platform, to protect files, to  
replace FTP servers and to allow access to files anytime, anywhere.  
  
The Thru Managed File Transfer application allows authenticated users to   
access the favourite contacts list of other users.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH identified a vulnerability in the functionality to display   
the favourite contacts list. These lists include email addresses of  
other users and can be directly accessed using the correct URL.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The favourite contacts lists of different users can be accessed when a   
user has a valid user account via the following URL  
  
https://[HOST]/App/asp/list_details.asp?listid=[ID]   
  
Here, merely the numeric parameter "listid" needs to be manipulated.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
The reported security vulnerability has been fixed in a new software  
release. Update to the new software version.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2015-12-09: Vulnerability discovered  
2015-12-09: Vulnerability reported to manufacturer  
2016-01-22: Manufacturer announced update  
2016-02-15: Public release of security advisory  
2016-03-02: Public release of revised security advisory (corrected   
solution status)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Thru Homepage  
http://www.thruinc.com  
[2] SySS Security Advisory SYSS-2015-064  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-064.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/news/responsible-disclosure-policy/  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Dr. Erlijn van Genuchten of the  
SySS GmbH.  
  
E-Mail: [email protected]  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Erlijn_vanGenuchten.asc  
Key ID: 0xBD96FF2A  
Key Fingerprint: 17BB 4CED 755A CBB3 2D47 C563 0CA5 8637 BD96 FF2A  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web  
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1  
  
iQIcBAEBCgAGBQJW1fdBAAoJEAylhje9lv8qeNsP/RaGhK3W8BlLWA7W7Uxo6lA9  
lxicKnnHZOg3odR4vSwELsCKvfJ46BDAFC6hS26yqNZTVyjtNsXgc3uCg+RtoWcE  
nsUJRUwMKDT3eFjifhRuYBKTyLeK8aARqLo74ZNJ/wySF+ETxTDa2wdEk3Wk6kY7  
1rtSEJ0u00fiQJaiCIYd6AYYDqwKPZwxsgaauBp3t53UvIJZ58YtiB7vlUoFdQxO  
tG5tvco1a5+XuRLUAK7V4OZvs/ghI/YYU13RSTpGoHX+13Y4MUAPS/kO5lpUVYBF  
hsHpZbWnSIU5Xk6MoWpDWZ+XXLvs2/rGg6c4FT4j3837gWwul11V5pDNqJ01C8Yc  
1iX04mgBLhcrgZKaJYHWwt/nXiqc+ox5mmpsclmrQMao06qizUdJqnzx5T9NU9Ge  
0frRL+jB3q+rhtB6GafomI4kJBFBuxVrKsTvbGkUz7sWkvhCtSB3EINLitFXm2TM  
AjZE/IwcU5ODcHAcVP856F9jt0KCH70UYmPb3XByDSGIOWpsCF1E7dlQTQ3aRdym  
wijKj8I8bbPrmrUxb/eZhlZxEzfMCxmI5AdAL1IaPvnR8eLx1XTcbAfJGCj262Or  
mQUv9Ke7iHATm30byYg/3OlCFIuI7a6xT5sd5TOGwaAjGqMTxYjksP9LKd8PMLc2  
mhNWNdVbBztFrlID2fmh  
=Xq7K  
-----END PGP SIGNATURE-----  
`