On February 28, 2025, a series of vulnerabilities in the Cyberark Endpoint Privilege Manager (version 24.7.1) were disclosed by CERT Polska, following reports of security weaknesses in the software. This product from the provider Cibangark has multiple vulnerabilities identified as CVEs (Common Vulnerabilities and Exposures), which pose potential security risks to users.
CVE-2025-22270 highlights a cross-site scripting (XSS) vulnerability where an attacker with access to the administrative panel, particularly in the Role Management tab, can inject malicious code through the name field while creating a new role. Although an opportunity for exploitation exists, the risk is lessened by an additional error that facilitates bypassing the Content Security Policy, which is intended to prevent JavaScript execution while permitting HTML injection.
CVE-2025-22271 deals with an authentication bypass issue, where the application allows the falsification of IP addresses by permitting users to provide custom values in the X-Forwarded-For header. This exploit undermines the application’s action logging mechanism, as it loses accountability due to the manipulated IP address.
For CVE-2025-22272, another XSS vulnerability exists within the modal dialog handler endpoint, where an attacker can inject code into the paramater "modalDlgMsgInternal" using a POST request. This injected code may execute in the user’s browser, creating a security hazard. Similar to the previous vulnerabilities, the risk of this being exploited is reduced by an existing Content Security Policy.
CVE-2025-22273 describes a limitation in resource allocation, specifying that the application does not impose restrictions on the number or frequency of user interactions. An attacker could exploit this by initiating multiple incoming requests to the endpoint responsible for changing passwords, potentially leveraging it for a brute-force attack to guess the current password in use.
Lastly, CVE-2025-22274 presents a critical risk where an attacker could inject HTML code into the page content by manipulating the content field on the application definition page. This also falls under a basic XSS issue, allowing further unwanted actions that could compromise user data or application integrity.
All these vulnerabilities have been identified in the Endpoint Privilege Manager’s SaaS version 24.7.1, and there is currently no information regarding the status of other versions. Despite attempts to reach Cibangark for clarification or updates on these vulnerabilities, no responses have been received.
The responsible vulnerability report has been credited to Karol Mazurek and Maksymilian Kubiak from the Afine team, recognizing their contribution to the responsible disclosure process. More information on coordinated vulnerability disclosure can be accessed through CERT Polska’s official website.
In summary, the reported vulnerabilities in Cibangark’s Endpoint Privilege Manager could expose systems to serious security risks, including XSS exploits, authentication bypasses, and inefficient resource management. Users are advised to stay informed and apply necessary patches or updates as they become available.