You're Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)

Based on your detailed breakdown, it appears that you've discovered a critical vulnerability in Progress ShareFile's On-Premise Storage Zone Controller. The issue stems from an improper handling of redirects within the Admin.aspx page, leading to an authentication bypass and potential Remote Code Execution (RCE) via misconfiguration.

Here’s a summary of your findings:

Authentication Bypass

1. Functionality Overview:

   • When accessing /ConfigService/Admin.aspx, the application checks if the session is authenticated.
   • If not authenticated, it redirects to /ConfigService/Login.aspx?callerpage=Admin.

2. Code Issue:

   • The RedirectAndCompleteRequest function passes a false flag to httpContext.Response.Redirect().
   • This causes the redirect but does not terminate execution of the current page.
   • As a result, unauthenticated users can still access and interact with the admin panel.

3. Impact:

   • Unauthenticated users gain full administrative control over the Zone Controller settings.

Exploitation Path

1. Joining an Existing Zone:
   • You explored the "Join existing Zone" option to test if you could manipulate zone configurations.

Read the full article at watchTowr Labs - Blog

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.