CVE-2025-54397

Executive Summary

CVE-2025-54397 is an information disclosure vulnerability in Netwrix Directory Manager (formerly Imanami GroupID) versions prior to 11.1.25162.02. The flaw allows authenticated users to access sensitive information that is inadvertently included in sent data. This could lead to unauthorized exposure of internal directory data, credentials, or other confidential information. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is significant for organizations using this identity management solution. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise software product (Netwrix Directory Manager) and is not related to open-source packages like NPM, PyPI, Go, or Ruby. The risk is primarily to organizations that have deployed this software within their Active Directory or identity management infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned/Placeholder)
• Attack Vector: Network (likely)
• Attack Complexity: Low (likely)
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium to High (depending on exposed data sensitivity)

Deep Dive & Mechanics

The vulnerability stems from the application including sensitive information (such as directory attributes, internal IP addresses, or authentication tokens) in data transmitted to authenticated users. This could occur in API responses, web pages, or log files that are accessible to users with valid credentials. The root cause is likely improper data sanitization or overly permissive data exposure in the application's response handling.

Attack Scenario:

1. An attacker obtains valid credentials (e.g., via phishing, weak passwords, or insider threat).
2. The attacker authenticates to the Netwrix Directory Manager web interface or API.
3. The attacker sends crafted requests or navigates to specific endpoints that return sensitive data.
4. The attacker extracts the exposed information (e.g., user hashes, group memberships, or configuration details).

Vulnerable vs. Patched Code

No specific code snippets are available. The patch (version 11.1.25162.02) likely implements stricter filtering of response data, ensuring that only necessary information is returned to authenticated users. The vulnerable code may have included all directory attributes in API responses, while the patched version limits output to non-sensitive fields.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Netwrix Directory Manager 11.0.0.0 in a lab environment with Active Directory integration.
2. Authentication: Obtain valid user credentials (e.g., testuser:Password123).
3. Exploitation:
   • Use a tool like Burp Suite or Postman to intercept and modify API requests.
   • Send a GET request to /api/users/current or similar endpoint.
   • Observe the response for sensitive fields like passwordHash, sid, or memberOf.
   • Extract and document the exposed data.

Blue Team

1. Detection: Monitor for unusual API calls from authenticated users, especially to endpoints that return user attributes.
2. Hunting: Search logs for requests to /api/users/* or /api/groups/* that return large amounts of data.
3. Mitigation: Apply the vendor patch immediately. If patching is delayed, restrict API access to only necessary users and monitor for anomalous behavior.

Indicators of Compromise (IOCs)

• Network: Unusual API requests to /api/users/* or /api/groups/* from authenticated users.
• Logs: Application logs showing repeated access to sensitive endpoints by non-admin users.
• Data: Exposure of fields like passwordHash, sid, memberOf, or distinguishedName in API responses.

Detection Engineering

YARA Rule

rule CVE_2025_54397_Netwrix_Info_Disclosure {
    meta:
        description = "Detects sensitive data exposure in Netwrix Directory Manager responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54397"
    strings:
        $sensitive1 = "passwordHash" ascii wide nocase
        $sensitive2 = "sid" ascii wide nocase
        $sensitive3 = "memberOf" ascii wide nocase
        $sensitive4 = "distinguishedName" ascii wide nocase
    condition:
        any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-54397 - Netwrix Directory Manager Sensitive Data Exposure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects API responses containing sensitive fields from Netwrix Directory Manager
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: netwrix_directory_manager
detection:
    selection:
        response_body|contains:
            - 'passwordHash'
            - 'sid'
            - 'memberOf'
            - 'distinguishedName'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54397 - Netwrix Directory Manager Sensitive Data Exposure"; flow:to_server,established; content:"passwordHash"; http_server_body; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54397 - Netwrix Directory Manager Sensitive Data Exposure"; flow:to_server,established; content:"sid"; http_server_body; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54397 - Netwrix Directory Manager Sensitive Data Exposure"; flow:to_server,established; content:"memberOf"; http_server_body; sid:1000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54397 - Netwrix Directory Manager Sensitive Data Exposure"; flow:to_server,established; content:"distinguishedName"; http_server_body; sid:1000004; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Netwrix Directory Manager version 11.1.25162.02 or later.
2. Workaround: If patching is not possible, restrict API access to only trusted users and monitor logs for anomalous access patterns.
3. Long-term: Implement least-privilege access controls for directory management interfaces. Regularly audit API responses for sensitive data leakage.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert