Parsec Cloud
Monthly
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain ...
NTLM credential theft and denial-of-service in Scille Parsec (parsec-cloud before 3.3.3-rc.0) arises because the Windows client mounts organization workspaces using their unsanitized names, and a workspace name containing backslashes can evaluate to a UNC path. A low-privileged organization member who names a workspace as an attacker-controlled UNC path (e.g. \\attacker\share) forces victim clients to reach out over SMB, leaking their NetNTLM hash to the attacker or hanging the application if the path is unreachable. Publicly available exploit code has not been identified and it is not in CISA KEV, though a fixed vendor release exists.
Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain ...