White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)

Impact

For European organizations using White Star Software Protop 4.4.2, this LFI vulnerability poses a significant risk to confidentiality and integrity. Successful exploitation can lead to unauthorized disclosure of sensitive internal files, including system configuration and credential files, which can be leveraged for further attacks. This can result in data breaches, regulatory non-compliance (notably GDPR violations), reputational damage, and operational disruptions. The unauthenticated and remote nature of the exploit increases the attack surface, allowing attackers to target exposed instances easily. Organizations in sectors with critical infrastructure or sensitive data—such as finance, healthcare, and government—are particularly vulnerable. The vulnerability could also serve as a foothold for advanced persistent threats aiming for privilege escalation or lateral movement within networks. Although no known exploits are currently observed in the wild, the public availability of exploit code heightens the likelihood of imminent exploitation attempts.