2021-12 - Synergetic Security Hotfix - 17th December 2021

Owned by Chris Savage
Last updated: Nov 12, 2023
2 min read

Issue

Where a person has valid user credentials and extensive technical knowledge of the Synergetic system, it may be possible for them to access some operations in SynWeb beyond their permission set. Customers with SAML and MFA in place have greater protection. Customers without SAML or MFA may wish to disable public access to SynWeb until they have implemented the hotfix described below.

Fix

A hotfix has been developed to update the affected Synergetic DLLs and javascript files on your web server. 

Please follow the instructions below to deploy this hotfix:

  1. Determine the version of Synergetic that you are running. To do this, go to SynWeb > Help > About and take note of the SynWeb Version.
  2. Download the relevant .zip file for your version from the list of files under the Resources section below.
  3. Download the Powershell script below.
  4. Copy these two files onto your web server, both into the same folder.
  5. Go to Internet Information Services on your web server and Stop the SynWeb site.
  6. Run Windows PowerShell as an administrator. 
  7. Go to the location where the above files were copied to and run the Powershell script with the patch zip file as a parameter. For example: SynWebAjaxUpdate.ps1 "SynWeb Ajax Patch v70.10.02.zip" 
    1. The script will make a backup copy of your current SynWeb folder in SynWeb-perAjaxHotfix.
    2. It will then copy the new versions of the files to your SynWeb folder.
  8. Once complete, go to Internet Information Services on your web server and Start the SynWeb site.

Outcome

Once complete, users with valid credentials will not be able to gain access to functions that are restricted.

Verification

  1. On your web server, go to your inetpub\wwwroot\SynWeb\bin folder.
  2. Ensure that Synergetic.SynWeb.Web.dll has a Date Modified in the month of January 2022.

Resources