CVE-2025-54394

Executive Summary

CVE-2025-54394 is a vulnerability in Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.01. The flaw involves insufficiently protected credentials when the application makes requests to remote Excel resources. An attacker who can intercept network traffic or access configuration files may extract embedded credentials, leading to unauthorized access to external data sources. The vulnerability has a CVSS score of 0.0 (unscored) and no public exploit code is available at this time. The patch is available in version 11.1.25162.02.

Supply Chain & Package Security

This vulnerability is not in an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (Netwrix Directory Manager). The risk is limited to organizations that deploy this specific software and use its Excel resource integration features.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Vector: UNKNOWN
• Attack Vector (AV): UNKNOWN
• Attack Complexity (AC): UNKNOWN
• Privileges Required (PR): UNKNOWN
• User Interaction (UI): UNKNOWN
• Scope (S): UNKNOWN
• Confidentiality (C): UNKNOWN
• Integrity (I): UNKNOWN
• Availability (A): UNKNOWN

Threat Level: Medium (based on insufficiently protected credentials and potential for lateral movement). The lack of a CVSS score and public exploit reduces immediate risk, but the nature of the flaw (credential exposure) warrants prompt patching.

Deep Dive & Mechanics

The vulnerability resides in how Netwrix Directory Manager handles authentication when fetching remote Excel files (e.g., from SharePoint, network shares, or cloud storage). The application stores or transmits credentials (usernames, passwords, API tokens) in a manner that is not sufficiently protected. This could occur in:

• Configuration files: Credentials stored in plaintext or weakly encrypted in XML/JSON config files.
• Network traffic: Credentials sent over HTTP without TLS or with weak encryption.
• Log files: Credentials inadvertently written to debug or audit logs.

An attacker with local access to the server, or who can perform man-in-the-middle (MITM) attacks on the network, could extract these credentials. Once obtained, the attacker could access the remote Excel resources, potentially containing sensitive data (user lists, group memberships, organizational data).

The root cause is a failure to apply standard security practices such as:

• Using secure credential storage (e.g., Windows Credential Manager, encrypted config sections).
• Enforcing TLS for all outbound connections.
• Masking credentials in logs and error messages.

Vulnerable vs. Patched Code

Vulnerable (11.0.0.0 – 11.1.25162.01):

// Example of vulnerable credential handling (conceptual)
public void FetchExcelData(string url, string username, string password)
{
    // Credentials passed in plaintext or stored in config
    var request = WebRequest.Create(url);
    string credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}"));
    request.Headers["Authorization"] = $"Basic {credentials}";
    // ... fetch data
}

Patched (11.1.25162.02):

// Example of patched credential handling (conceptual)
public void FetchExcelData(string url, string username, string password)
{
    // Use secure credential storage and TLS
    var securePassword = new SecureString();
    foreach (char c in password) securePassword.AppendChar(c);
    var credential = new NetworkCredential(username, securePassword);
    
    var request = WebRequest.Create(url);
    request.Credentials = credential;
    request.PreAuthenticate = true;
    // Enforce TLS 1.2+
    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    // ... fetch data
}

The patch likely involves:

• Moving credentials to secure storage (e.g., Windows Credential Manager).
• Enforcing HTTPS/TLS for all remote Excel connections.
• Removing credential logging.
• Encrypting credential sections in configuration files.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Netwrix Directory Manager server (local or network access).
• Ability to intercept traffic (MITM) or read configuration files.

Exploitation Steps:

1. Identify Configuration Files: Locate web.config, appsettings.json, or custom XML files in the installation directory (e.g., C:\Program Files\Netwrix Directory Manager\).
2. Extract Credentials: Search for keywords like password, username, connectionString, or ExcelResource in plaintext or weakly encoded strings.
3. Intercept Network Traffic: Use a tool like Wireshark or Burp Suite to capture HTTP requests to remote Excel endpoints. Look for Authorization: Basic headers or other credential-bearing fields.
4. Decode Credentials: If Base64 encoded, decode to plaintext.
5. Access Remote Resource: Use the extracted credentials to log into the remote Excel resource (e.g., SharePoint, file share) and exfiltrate data.

Example (conceptual):

# Search for credentials in config files
grep -r "password" "C:\Program Files\Netwrix Directory Manager\*.config"

# Decode Base64 from intercepted traffic
echo "dXNlcjpwYXNz" | base64 -d

Blue Team

Detection Steps:

1. Monitor Configuration File Access: Alert on unauthorized reads of web.config or similar files.
2. Network Monitoring: Detect outbound HTTP (non-HTTPS) connections from the Directory Manager server to remote Excel endpoints.
3. Credential Exposure: Scan logs for plaintext passwords or Base64-encoded credentials.
4. Patch Verification: Ensure all instances are running version 11.1.25162.02 or later.

Hunting Query (Splunk):

index=windows sourcetype=WinEventLog:Security EventCode=4663
| search ObjectName="*web.config*" OR ObjectName="*appsettings.json*"
| stats count by User, ComputerName

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – no public exploit)
• Network Indicators:
  • Outbound HTTP requests to remote Excel endpoints (e.g., http://sharepoint.company.com/sites/...)
  • Authorization: Basic headers in outbound traffic from the Directory Manager server.
• Registry Keys: (None specific)
• Log Entries:
  • Event ID 4663 (File Read) on configuration files.
  • Application logs containing password or credentials in plaintext.

Detection Engineering

YARA Rule

rule Detect_Netwrix_Credential_Exposure {
    meta:
        description = "Detects plaintext or Base64-encoded credentials in Netwrix Directory Manager config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54394"
    strings:
        $password = "password" nocase
        $username = "username" nocase
        $base64 = /[A-Za-z0-9+\/]{20,}={0,2}/ 
        $excel_resource = "ExcelResource" nocase
    condition:
        any of ($password, $username) and $excel_resource and #base64 > 0
}

Sigma Rule

title: Netwrix Directory Manager Credential Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to Netwrix Directory Manager configuration files that may contain exposed credentials
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54394
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains:
            - 'web.config'
            - 'appsettings.json'
            - 'Netwrix Directory Manager'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54394 - Netwrix Directory Manager Credential Exposure"; flow:to_server; content:"Authorization|3a| Basic"; http_header; content:"Excel"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Netwrix Directory Manager version 11.1.25162.02 or later.
2. Credential Rotation: Change all passwords and API keys used for remote Excel resources.
3. Network Segmentation: Restrict outbound traffic from the Directory Manager server to only necessary endpoints.
4. Enable TLS: Ensure all remote Excel connections use HTTPS/TLS 1.2+.

Long-Term Measures:

• Implement a credential management solution (e.g., HashiCorp Vault, Azure Key Vault).
• Conduct regular security audits of configuration files.
• Enable logging and monitoring for credential access.
• Apply the principle of least privilege to service accounts.

Workaround (if patching is delayed):

• Manually encrypt credential sections in configuration files using aspnet_regiis.exe (for IIS).
• Use network-level encryption (IPsec) for all traffic to remote Excel resources.

Valters IT