{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/centrestack/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-54367"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CentreStack (\u003c 17.2)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","cve-2026-54367","api-security"],"_cs_type":"advisory","_cs_vendors":["CentreStack"],"content_html":"\u003cp\u003eCentreStack versions prior to 17.2 contain a critical authentication bypass vulnerability (CVE-2026-54367) originating from exposed API endpoints that fail to enforce necessary authorization checks. By leveraging a static shared encryption key, an unauthenticated attacker can generate valid, encrypted EntAcctId values. These values allow the attacker to forge identifiers for any user GUID, including those associated with system-wide cluster settings. Successful exploitation permits an attacker to perform unauthorized read, write, and delete operations on arbitrary account settings, and provides the capability to enumerate hosted tenant domains and administrative identities. This flaw poses a significant risk to organizations relying on CentreStack for managed file services, as it enables deep unauthorized access to the platform configuration and user data structures.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated attackers to gain administrative-level visibility and control over the platform's account settings. This leads to the exposure of sensitive organizational tenant information, potential account takeover of administrative roles, and the ability to modify core system configurations. The compromise of tenant enumeration and administrative identity metadata significantly increases the risk of further targeted attacks against the organization's infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all CentreStack deployments to version 17.2 or later immediately to remediate CVE-2026-54367.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous, high-frequency POST or GET requests targeting API endpoints associated with user or cluster setting management.\u003c/li\u003e\n\u003cli\u003ePerform a security audit of current administrative accounts to ensure no unauthorized identities or modified settings were introduced while the system was unpatched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-30T13:41:11Z","date_published":"2026-07-30T13:41:11Z","id":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-auth-bypass/","summary":"CentreStack versions prior to 17.2 are vulnerable to an authentication bypass that allows unauthenticated attackers to manipulate account settings and enumerate system data via exposed API endpoints.","title":"Authentication Bypass Vulnerability in CentreStack","url":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-auth-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-54366"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CentreStack (\u003c 17.4)"],"_cs_severities":["high"],"_cs_tags":["xxe","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["CentreStack"],"content_html":"\u003cp\u003eCentreStack versions prior to 17.4 contain an XML external entity (XXE) injection vulnerability in the SharePoint storage configuration handler. This flaw allows an unauthenticated attacker to supply a malicious URL to the StorageConfig endpoint. The vulnerability exists because the application improperly processes user-supplied XML data without sufficient validation, permitting the inclusion of external DTD references. By sending a crafted request, an attacker can force the server to parse an external entity and exfiltrate the contents of local files out-of-band. This represents a significant risk, as the exfiltration of files such as Web.config can expose sensitive database credentials, configuration details, and cryptographic keys, leading to full system compromise or unauthorized access to backend storage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies the target instance of CentreStack accessible via the internet.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an XML payload containing a malicious external DTD reference targeting a local file (e.g., Web.config).\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated HTTP POST request to the /StorageConfig endpoint of the CentreStack application.\u003c/li\u003e\n\u003cli\u003eThe application processes the malicious XML payload within the SharePoint storage configuration handler.\u003c/li\u003e\n\u003cli\u003eThe server performs an out-of-band request to the attacker-controlled DTD server as instructed by the XXE payload.\u003c/li\u003e\n\u003cli\u003eThe server reads the target file content and includes it in the communication or triggers a side-channel exfiltration of the data.\u003c/li\u003e\n\u003cli\u003eThe attacker captures the exfiltrated sensitive data, such as database credentials or encryption keys, from their controlled server.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen credentials to gain persistent or elevated access to the CentreStack backend and associated storage environments.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read arbitrary files from the filesystem of the hosting server. In typical enterprise deployments, this leads to the compromise of Web.config files, resulting in the theft of database connection strings, administrative credentials, and cryptographic keys. This impact compromises the confidentiality of all data managed by the CentreStack instance and enables further lateral movement into linked storage services like SharePoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all instances of CentreStack to version 17.4 or later immediately to patch CVE-2026-54366.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to webserver access logs to detect potential XXE probe attempts targeting the StorageConfig endpoint.\u003c/li\u003e\n\u003cli\u003eReview web server logs for HTTP requests to the StorageConfig endpoint originating from unexpected or untrusted external IP addresses.\u003c/li\u003e\n\u003cli\u003eIf an instance was compromised, rotate all database credentials, API keys, and cryptographic secrets stored within Web.config and application settings.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-30T13:41:18Z","date_published":"2026-07-30T13:41:05Z","id":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-xxe/","summary":"CentreStack versions prior to 17.4 are vulnerable to an unauthenticated XXE injection via the SharePoint storage configuration handler, allowing attackers to exfiltrate sensitive server-side files.","title":"CVE-2026-54366 CentreStack XXE Injection","url":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-xxe/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-54363"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CentreStack (\u003c 17.5)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","remote-code-execution","hardcoded-key"],"_cs_type":"advisory","_cs_vendors":["CentreStack"],"content_html":"\u003cp\u003eCentreStack versions prior to 17.5 contain a critical cryptographic vulnerability where a hardcoded 'SysNumber' value is utilized as entropy for the AccessTicket.Encrypt() and AccessTicket.Decrypt() functions. Because this key is consistent across all installations, an unauthenticated attacker can effectively forge encrypted tokens. By crafting valid 'x-glad-auth' headers, an attacker can bypass authentication to access sensitive, privileged API endpoints. A primary objective identified for this exploit chain is the 'acquiretenantbackuptoken' endpoint, which facilitates the retrieval of a Domain Administrator IdentityTicket. Successful exploitation grants the attacker administrative control over the CentreStack instance, enabling remote code execution on the underlying server. This vulnerability represents a significant risk to organizations managing file server access and remote data synchronization via CentreStack, as it provides a direct path from unauthenticated network access to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies an internet-facing CentreStack instance.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the known hardcoded 'SysNumber' to replicate the encryption routine used for AccessTicket generation.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious 'x-glad-auth' HTTP header using the forged token.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a crafted request to the 'acquiretenantbackuptoken' privileged API endpoint.\u003c/li\u003e\n\u003cli\u003eThe backend service validates the forged token as authentic due to the static entropy key.\u003c/li\u003e\n\u003cli\u003eThe server returns a high-privileged Domain Administrator IdentityTicket to the attacker.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the stolen IdentityTicket to authenticate to administrative API endpoints.\u003c/li\u003e\n\u003cli\u003eThe attacker interacts with file management or configuration APIs to execute arbitrary commands on the host server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to full unauthenticated remote code execution on the affected CentreStack server. This allows for complete data exfiltration, modification of system configurations, and lateral movement within the corporate network. Because this is a systemic vulnerability in the product's cryptographic implementation, all installations prior to version 17.5 are at risk of total compromise without requiring prior knowledge of legitimate user credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CentreStack instances to version 17.5 or later immediately as the primary remediation for CVE-2026-54363.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for anomalous 'POST' or 'GET' requests to the '/acquiretenantbackuptoken' API endpoint originating from non-authenticated or external IP addresses.\u003c/li\u003e\n\u003cli\u003eImplement strict network perimeter controls to restrict access to CentreStack management API endpoints to trusted internal IP ranges only.\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to inspect and filter suspicious 'x-glad-auth' headers that deviate from expected token formatting or originate from suspicious sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-30T13:40:33Z","date_published":"2026-07-30T13:40:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-hardcoded-key/","summary":"CentreStack versions prior to 17.5 contain a hardcoded cryptographic key vulnerability, allowing unauthenticated attackers to forge authentication tokens and execute arbitrary code.","title":"Authentication Bypass and RCE in CentreStack via Hardcoded Cryptographic Key","url":"https://feed.craftedsignal.io/briefs/2026-07-centrestack-hardcoded-key/"}],"language":"en","title":"CraftedSignal Threat Feed - CentreStack","version":"https://jsonfeed.org/version/1.1"}