CVE-2022-25152 ITarian - Any user with a valid session token can create and execute agent procedures and bypass mandatory approvals
Authenticated users can bypass mandatory approval workflows to execute arbitrary code on managed agents, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25152?
CVE-2022-25152 is a critical missing authorization vulnerability in ITarian platform (SAAS / on-premise), published on 8 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.
Weakness: CWE-358
Which versions are affected by CVE-2022-25152?
It affects 2 products.
Products include Itarian On-Premise, Itarian Saas Service Desk.
How do I fix CVE-2022-25152?
No fix has been published for CVE-2022-25152 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-25152 being exploited?
There is no known exploitation of CVE-2022-25152 in the wild and no public exploit code.
Other vulnerabilities in ITarian platform (SAAS / on-premise)
Sources
Also known as GHSA-cwjr-66gj-xm4q.