Kofax Capture
Monthly
Unauthenticated remote file read/write and NTLM coercion in Kofax Capture (rebranded Tungsten Capture) 6.0.0.0 stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on TCP/2424 with a default, publicly known endpoint identifier and no authentication. A remote attacker can abuse .NET Remoting object unmarshalling to instantiate a server-side System.Net.WebClient, allowing arbitrary file read/write and coerced NTLMv2 authentication that can cascade into credential theft, denial of service, remote code execution, or lateral movement depending on the service account's privileges. Publicly available exploit code exists (VulnCheck/gist PoC); it is not listed in CISA KEV, and EPSS is low at 0.16% (37th percentile).
The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote file read/write and NTLM coercion in Kofax Capture (rebranded Tungsten Capture) 6.0.0.0 stems from the Ascent Capture Service exposing a deprecated .NET Remoting HTTP channel on TCP/2424 with a default, publicly known endpoint identifier and no authentication. A remote attacker can abuse .NET Remoting object unmarshalling to instantiate a server-side System.Net.WebClient, allowing arbitrary file read/write and coerced NTLMv2 authentication that can cascade into credential theft, denial of service, remote code execution, or lateral movement depending on the service account's privileges. Publicly available exploit code exists (VulnCheck/gist PoC); it is not listed in CISA KEV, and EPSS is low at 0.16% (37th percentile).
The application is vulnerable to Stored Cross-Site Scripting (XSS) in the endpoint /sofer/DocumentService.asc/SaveAnnotation, where input data transmitted via the POST method in the parameters author. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.