Compromising Citrix ShareFile on-premise via 7 chained vulnerabilities

Fox-IT analyzed Citrix ShareFile's on-premise StorageZone controller and documented a chain of eight vulnerabilities—multiple path traversals in ZIP extraction and upload IDs, weak/guessable integrity checks on info/token files, HMAC verification flaws (HTTP parameter pollution), and debug information disclosure—that together allow any account able to upload files to read, modify, and download arbitrary files (including encrypted storage) from vulnerable on-premise StorageZone installations; Citrix deployed mitigations after coordinated disclosure.