The company said in a statement that it had been using the FTA to securely transfer large data files.
Incorporated in the UK, the Dutch company, which is officially known as Royal Dutch Shell, is the fifth largest firm globally going by 2020 revenue, according to Wikipedia. It reported revenue of US$180.5 billion (A$237 billion) last year and the number of employees was reported as 86,000 this year.
There have been a number of companies that have been attacked through the same product, including Transport for NSW and Singapore telco Singtel.
{loadpositon sam08}There are four vulnerabilities in the FTA appliance which have been tracked according to the following CVEs, according to Accellion.
CVE-2021-27101 – SQL injection via a crafted Host header.
CVE-2021-27102 – OS command execution via a local Web service call.
CVE-2021-27103 – SSRF via a crafted POST request.
CVE-2021-27104 – OS command execution via a crafted POST request.
The Shell statement did not indicate when it had found about the breach.
"Upon learning of the incident, Shell addressed the vulnerabilities with its service provider and cyber security team, and started an investigation to better understand the nature and extent of the incident," the company statement said.
"There is no evidence of any impact to Shell’s core IT systems as the file transfer service is isolated from the rest of Shell’s digital infrastructure."
The company said it had found "an unauthorised party gained access to various files during a limited window of time".
"Some contained personal data and others included data from Shell companies and some of their stakeholders.
"Shell is in contact with the impacted individuals and stakeholders and we are working with them to address possible risks. We have also been in contact with relevant regulators and authorities and will continue to do so as the investigation continues," the statement ended.
"Cyber security and personal data privacy are important for Shell and we work continuously to improve our information risk management practices. We will continue to monitor our IT systems and improve our security. We regret the concern and inconvenience this may cause affected parties."
