#affecting Citrix ShareFile Storage Zones Controller

[hivepro]

A remote code execution (RCE) vulnerability(CVE-2021-22941) affecting Citrix ShareFile Storage Zones Controller, was used by Prophet Spider to attack a Microsoft Internet Information Services (IIS) web server. The attacker took advantage of the flaw to launch a WebShell that allowed the download of further tools.

Prophet Spider also exploits known Log4j vulnerabilities in VMware Horizon (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832). Prophet Spider most typically used encoded PowerShell instructions to download a second-stage payload to the targeted PCs after exploiting the vulnerabilities. The specifics of that payload are determined by the attacker’s motivations and aims, such as crypto mining, ransomware, and extortion.

[cvereport]

CVE-2021-22932

An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected by this issue if they previously selected “Enable Encryption” in the ShareFile configuration page and did not re-select this setting after running the CTX269106 mitigation tool. ShareFile customers who have not run the CTX269106 mitigation tool or who re-selected “Enable Encryption” immediately after running the tool are unaffected by this issue. source https://cve.report/CVE-2021-22932

[kalilinux4u]

According to Citrix, the following 3 vulnerabilities affect customer-managed on-premises ShareFile storage zone controllers, a component that stores corporate data behind the firewall. ✅ CVE-2020-7473 ✅ CVE-2020-8982 ✅ CVE-2020-8983 (via Twitter http://twitter.com/TheHackersNews/status/1257710823004225536)