Kiteworks eases shutdown after isolating security flaw

Kiteworks has withdrawn its broad precautionary shutdown recommendation for most customers after an emergency security review isolated a critical vulnerability to its Advanced Forms product, while installations using that feature were advised to remain offline pending a fix.

The secure file-transfer and private-data communications company had asked customers worldwide to take systems offline during a weekend window after receiving what it described as credible intelligence from federal authorities that a threat actor might target Kiteworks deployments. The unusual measure was preventive, and the company said it had found no evidence that its systems or customer environments had been compromised.

Kiteworks said during the shutdown and with assistance from intelligence authorities it identified a critical vulnerability chain affecting Advanced Forms, also known as Secure Data Forms. The company said the feature was enabled for fewer than 1 per cent of customers, representing fewer than 50 organisations, and that the weakness was confined to that product.

Customers not using Advanced Forms were told they could restart their systems, and Kiteworks said it had restored the environments it hosts for those customers. Users of Advanced Forms were given separate guidance and advised to keep affected systems offline while the company prepared and deployed a remedy.

The update substantially narrowed the scope of the initial alert, which had applied to self-managed Kiteworks installations running on premises and in Amazon Web Services or Microsoft Azure environments. Kiteworks also temporarily shut down systems that it hosts on customers’ behalf, meaning hosted customers did not have to perform the shutdown themselves.

Frank Balonis, Kiteworks’ chief information security officer, said when the warning was issued that federal intelligence authorities had provided credible information indicating a threat actor might attempt to target some customer systems. He said the company chose a precautionary shutdown while it worked with authorities because there was no indication at that stage that a compromise had occurred.

The original advisory recommended a nine-hour shutdown window according to customers’ local time zones. Earlier customer communications had raised concern about a possible zero-day attack — exploitation of a vulnerability unknown to the vendor or for which a protective fix is not yet available — because Kiteworks could not initially exclude unknown routes into affected systems.

Kiteworks said its continuous monitoring had detected no anomalous activity associated with the Advanced Forms weakness and that it had no indication the vulnerability had been exploited. It also said it was sharing intelligence with industry partners, including Mandiant, as work continued to address the issue.

Before the Advanced Forms flaw was identified, Kiteworks said all vulnerabilities then known to the company were addressed in software release 9.5.1. It urged customers to run the latest release, a recommendation that remains important even for installations cleared to return to service because the emergency investigation concerned the possibility of an unknown vulnerability rather than an already catalogued defect.

The company has not publicly identified the threat actor, disclosed the precise attack technique or named the federal authority that supplied the intelligence. No public vulnerability identifier accompanied the initial advisory, limiting the technical information available to security teams outside direct customer communications.

Kiteworks provides technology used by organisations to exchange sensitive files and other private data. That makes externally accessible file-transfer systems attractive targets for attackers seeking large quantities of confidential information, and vulnerabilities in such products can carry consequences across multiple organisations when exploitation is automated.

The company was formerly known as Accellion. Its legacy File Transfer Appliance was targeted in a major data-theft campaign in 2020 and 2021 in which attackers exploited previously unknown vulnerabilities against organisations using the product. The current Kiteworks alert concerns a different platform generation, and the company has not linked the present threat intelligence to that earlier campaign.

Kiteworks said other functions, including file collaboration, file transfer, email encryption, application programming interfaces and managed file transfer, were unaffected by the Advanced Forms vulnerability. It had also said subsidiaries including Zivver, DRACOON, totemo, ownCloud, WAMNET and 123FormBuilder were outside the scope of the original threat advisory.