Aishu AnyShare Information Disclosure Scanner

Aishu AnyShare is an intelligent content management platform used by organizations for efficient document management and collaboration. It is widely adopted by businesses needing to manage vast arrays of documents securely and accessibly. The platform facilitates file sharing and collaboration both internally and externally. Users can access files via multiple devices and ensure these files are synced across shared locations. Aishu AnyShare is valued for its secure data access and reliable content management capabilities.

The vulnerability in question is an information disclosure flaw that affects the Usrm_GetAllUsers interface within Aishu AnyShare. This vulnerability allows unauthenticated attackers to access sensitive information such as usernames and passwords. Exploitation of this vulnerability essentially places confidential account details at risk of exposure. This flaw poses a significant security concern, potentially allowing unauthorized access to the AnyShare management system. Addressing this vulnerability is critical to maintaining confidentiality and access control.

Technical details of this vulnerability include exploitation through a specific endpoint, /api/ShareMgnt/Usrm_GetAllUsers. An attacker can send a crafted HTTP POST request to this endpoint and retrieve user-related data. The response from the server reveals sensitive fields such as "loginName" and "password", which are crucial for unauthorized system entry. The matchers within the scan confirm the presence of these fields and their corresponding data types and values. Additionally, the API response is expected to return a status code 200, validating the request.

When exploited, this information disclosure vulnerability can lead to unauthorized access to user accounts, causing potential data breaches. Attackers gaining such access can manipulate account settings, steal sensitive data, and disrupt normal operations. The revealed credentials could further be used to facilitate additional attacks, increasing the breadth of potential damage. Organizations utilizing Aishu AnyShare should prioritize patching this vulnerability to prevent information leaks and unauthorized system access.