CVE-2024-5276

What it actually does

CVE-2024-5276 is a SQL injection flaw in Fortra FileCatalyst Workflow versions 5.1.6 Build 135 and earlier. A crafted HTTP request can cause attacker-controlled SQL to be executed against the application database. The most important impact is integrity compromise: attackers can insert, update, or delete application records, including creating administrative users or altering existing user records. Direct data exfiltration through the SQL injection primitive is reported as not possible, but an attacker who creates or modifies an administrative account may gain access to sensitive data through normal application functionality. Exploitation is unauthenticated when anonymous access is enabled; otherwise, an authenticated user account is required.

Why it matters to the business

A successful attack can let an external attacker take over the FileCatalyst Workflow application, create administrator accounts, disrupt managed file-transfer workflows, alter or delete operational data, and potentially access sensitive files or workflow metadata through the application. Because the exploit is weaponized and EPSS is very high, internet-exposed instances should be treated as high-priority even though this is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed FileCatalyst Workflow instance and determines whether anonymous access is enabled. If anonymous access is enabled, the attacker can send a malicious unauthenticated request to the vulnerable workflow functionality; if not, the attacker needs valid credentials. The request contains SQL syntax embedded in a vulnerable parameter, causing the application to execute attacker-controlled database operations using the application’s database privileges. The attacker can then create a new administrative user, modify roles or passwords, alter workflow data, or delete records. After creating or modifying an account, the attacker may log in through the normal web interface to maintain access, change configuration, interfere with transfers, or use legitimate application features to reach data that could not be directly extracted through the SQL injection itself.

How to fix it

Upgrade Fortra FileCatalyst Workflow to a vendor-fixed release newer than 5.1.6 Build 135. If an exact fixed build is not available in the asset inventory, obtain the latest FileCatalyst Workflow release directly from Fortra and confirm that the vendor advisory for CVE-2024-5276 is addressed. As immediate mitigations, disable anonymous access unless it is strictly required, restrict FileCatalyst Workflow access to trusted networks or VPN, place the service behind WAF rules that block SQL injection payloads, and review database permissions so the application account has only the minimum required privileges. Rotate credentials for any suspicious or newly created administrative accounts after remediation.

How to confirm the fix worked

Confirm the installed FileCatalyst Workflow version and build are newer than 5.1.6 Build 135. Verify anonymous access is disabled unless explicitly required and approved. From an external or low-privileged test position, confirm that unauthenticated workflow actions cannot be reached. Review vendor release notes or package metadata to confirm the CVE fix is present. Validate WAF or reverse-proxy protections by testing that SQL metacharacter payloads are blocked or logged. Finally, inspect the application user list, administrator group membership, recent password changes, and database audit records for unauthorized changes before declaring the system clean.

Typical attack path

1. Scan for internet-facing Fortra FileCatalyst Workflow instances.
2. Check whether the instance is running version 5.1.6 Build 135 or earlier and whether anonymous access is enabled.
3. Send crafted HTTP requests containing SQL injection payloads to the vulnerable workflow functionality.
4. Use injected SQL to insert or modify application database records, commonly to create an administrator account or elevate an existing user.
5. Authenticate to the application using the newly created or modified account.
6. Modify, delete, or disrupt workflow data and application configuration; potentially access sensitive content through normal application permissions.
7. Clean up obvious traces such as test users or failed requests, if the attacker attempts stealth.

How to detect it

Investigate web server, reverse proxy, WAF, FileCatalyst Workflow application logs, authentication logs, and database audit logs. Look for HTTP requests containing SQL metacharacters, comments, stacked-query separators, database function names, or suspicious boolean conditions, especially against workflow endpoints accessible without authentication. Correlate SQL error messages or HTTP 500 responses with subsequent successful logins from the same source IP. Review application audit trails for new administrator accounts, unexpected user creation, role changes, password resets, changed email addresses, deleted jobs, modified workflows, or configuration changes. In database logs, look for INSERT, UPDATE, or DELETE activity against user, role, permission, workflow, job, or configuration tables that occurred through the application account at unusual times or immediately after suspicious HTTP requests. Because weaponized exploitation exists, absence of obvious SQL errors is not sufficient; also hunt for successful state changes and account persistence.

• java.sql.SQLException
• SQLSyntaxErrorException
• org.hibernate.exception.SQLGrammarException
• UNION SELECT
• INFORMATION_SCHEMA
• WAITFOR DELAY
• SLEEP(
• pg_sleep(
• ' OR '1'='1
• " OR "1"="1
• ';--
• ";--
• /*
• */
• xp_cmdshell
• INSERT INTO
• UPDATE users
• DELETE FROM

What your security team should do

• Patch or upgrade all FileCatalyst Workflow systems running 5.1.6 Build 135 or earlier as an emergency priority, especially internet-facing deployments.
• Immediately disable anonymous access where business processes do not require it.
• Restrict access to the application using VPN, IP allowlists, reverse proxy controls, or network segmentation.
• Hunt for newly created administrator accounts, unexpected role changes, password resets, and unusual database writes from the application account.
• Review web, WAF, application, and database logs for SQL injection payloads and suspicious requests followed by successful logins.
• Rotate credentials and invalidate sessions for suspicious accounts after patching.
• Create SIEM detections for SQL injection strings targeting FileCatalyst Workflow and for administrative account creation from unusual source IPs.
• Back up and verify integrity of workflow configuration and application database records in case rollback is required.