Progress Urges Immediate Shutdown of ShareFile Servers Over Hacking Threat

Progress Software has sent an urgent email warning to ShareFile customers using on-premises Storage Zone Controllers. In the message, the company demands that the affected servers be shut down immediately.

The warning was prompted by the discovery of what Progress calls a “credible” external security threat targeting the on-premises version of the ShareFile secure file-sharing solution.

What we know

ShareFile is a platform for secure file sharing and storage that Progress Software offers to enterprise customers. Storage Zone Controllers are a component that lets organizations host ShareFile data storage on their own infrastructure rather than in the cloud.

It is the users of this on-premises configuration that the company is warning about the threat, recommending they stop running the servers as soon as possible until further instructions are provided.

Response and next steps

Progress Software has not yet disclosed the technical details of the threat — it is unclear whether this involves a vulnerability already being exploited or signs of an attack in the making. The company characterized the risk as serious enough to justify an emergency server shutdown even before a patch or official guidance is released.

For organizations using the cloud version of ShareFile, the threat apparently does not apply — the warning concerns specifically on-premises deployments with Storage Zone Controllers.

Progress Software's history already includes major incidents involving its file-transfer products: previously, vulnerabilities in another of the company's products, MOVEit Transfer, were used by attackers for large-scale supply-chain attacks. This may explain the company's heightened caution and its willingness to advise customers to shut down servers immediately, even before the situation is fully clarified.

Administrators using ShareFile with on-premises storage should keep an eye on Progress Software's official channels for further guidance and patches.

Source: Bleeping Computer