Unauthenticated Directory Enumeration in Remote Sunrise Helper for Windows 2026.14

Vulnerability Description: This vulnerability is classified as an information disclosure / improper access control flaw. The root cause is the absence of authentication enforcement on file/directory listing endpoints within Remote Sunrise Helper. An unauthenticated attacker positioned on the network (or internet, depending on exposure) can issue requests to enumerate filesystem contents without credentials, violating the principle of least privilege. The impact includes exposure of sensitive file paths, configuration details, and potential discovery of credentials or private data inadvertently stored in accessible locations.

PoC Significance: The PoC demonstrates reliable, unauthenticated access to directory listing functionality. This proves the authentication control is entirely missing rather than weakly configured. Such disclosure is a critical precursor to privilege escalation, lateral movement, or targeted data exfiltration; attackers can map the target system's structure before launching secondary exploits.

Detection Guidance: Defenders should monitor for: (1) HTTP requests to the Remote Sunrise Helper service lacking authentication tokens or session cookies; (2) unusual frequency of directory enumeration requests (e.g., patterns suggesting automated crawling); (3) access logs showing requests from unexpected network segments; (4) YARA/signature rules matching enumerate-like query patterns (e.g., GET /api/files, GET /api/browse). Enable detailed request logging, including query parameters and response sizes.

Mitigation Steps:

• Patch immediately: Update to a patched version if available; check the vendor's security advisory.
• Network segmentation: Restrict access to the Remote Sunrise Helper service to trusted internal networks only.
• Authentication enforcement: If a patch is unavailable, implement reverse-proxy authentication (e.g., WAF rules requiring valid credentials) in front of the service.
• Audit exposed instances: Scan internal and external-facing systems running this software; review access logs for evidence of exploitation.

Risk Assessment: Likelihood of in-the-wild exploitation is moderate to high because directory enumeration is a low-effort reconnaissance technique with immediate utility. Threat actors conducting network reconnaissance or targeting organizations running this software will likely probe for this weakness. The unauthenticated nature and information-disclosure payload make it attractive for initial access and situational awareness phases of attack campaigns.