CVE-2024-27790: Claris FileMaker Server Auth Bypass Flaw

CVE-2024-27790 Overview

CVE-2024-27790 is a broken access control vulnerability [CWE-284] in Claris FileMaker Server. The flaw allows remote unauthenticated attackers to access records stored in databases hosted on affected servers. The issue stems from the server replying to client requests without properly validating transactions first.

Claris International resolved the vulnerability in FileMaker Server 20.3.2 by adding transaction validation prior to responding to client requests. The vulnerability is network-exploitable, requires no privileges, and no user interaction.

Critical Impact
Remote attackers can read confidential records from databases hosted on unpatched FileMaker Server instances without authentication.

Affected Products

Claris FileMaker Server versions prior to 20.3.2

Discovery Timeline

2024-05-14 - CVE-2024-27790 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27790

Vulnerability Analysis

CVE-2024-27790 is a broken access control issue [CWE-284] in Claris FileMaker Server. The server processes and responds to client requests for database records without first validating the associated transaction context. As a result, an attacker can craft requests that elicit responses containing records the client should not be authorized to view.

The vulnerability affects the confidentiality of data hosted by FileMaker Server. The CVSS vector indicates impact is limited to information disclosure, with integrity and availability unaffected. Exploitation requires only network reachability to the FileMaker Server service.

Root Cause

The root cause is the absence of transaction validation prior to the server replying to client requests. FileMaker Server returned record data without confirming that the requesting transaction was authorized to retrieve the targeted records. Claris addressed this in version 20.3.2 by inserting validation logic before responses are generated.

Attack Vector

An attacker with network access to a FileMaker Server instance can issue requests that cause the server to disclose stored records. No credentials and no user interaction are required. The attack does not require local access, elevated privileges, or social engineering. Because FileMaker Server is commonly used to host business-critical databases, exposed records may include customer data, financial information, or proprietary records.

No public proof-of-concept exploit has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Claris Support Article for vendor-supplied technical context.

Detection Methods for CVE-2024-27790

Indicators of Compromise

Unusual volumes of read requests to FileMaker Server from a single client IP or session
FileMaker Server responses containing records that the requesting client account is not authorized to access
Network connections to FileMaker Server on TCP ports 5003 and 443 from untrusted source addresses

Detection Strategies

Monitor FileMaker Server access logs for anomalous query patterns, particularly broad record retrievals without prior authentication binding
Compare retrieved record sets against the privilege set of the requesting account to identify out-of-scope data access
Inspect server version banners and confirm whether the deployed build is earlier than 20.3.2

Monitoring Recommendations

Forward FileMaker Server logs to a centralized SIEM or data lake for correlation against network telemetry
Establish baselines for request volumes per client and alert on deviations
Track outbound data volumes from FileMaker Server hosts to detect bulk record exfiltration

How to Mitigate CVE-2024-27790

Immediate Actions Required

Upgrade FileMaker Server to version 20.3.2 or later as published by Claris
Inventory all FileMaker Server deployments and confirm patch status across production and development environments
Restrict network exposure of FileMaker Server to trusted networks and VPN clients only
Review database access logs for evidence of unauthorized record retrieval prior to patching

Patch Information

Claris released FileMaker Server 20.3.2 to remediate CVE-2024-27790. The fix introduces transaction validation before the server replies to client requests. Patch details are available in the Claris Support Article.

Workarounds

Block inbound access to FileMaker Server from untrusted networks at the perimeter firewall until patching is complete
Limit FileMaker Server connectivity to specific client IP ranges using host-based firewall rules
Enforce least-privilege account configuration so any disclosed data is minimized

bash

# Example: Restrict FileMaker Server access to trusted subnets (Linux iptables)
iptables -A INPUT -p tcp --dport 5003 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443  -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5003 -j DROP
iptables -A INPUT -p tcp --dport 443  -j DROP