CVE-2025-59270

Executive Summary

CVE-2025-59270 is a low-severity (CVSS 3.1) vulnerability in the CyberArk psPAS PowerShell module. The flaw resides in the Get-PASSAMLResponse function, which fails to explicitly enforce TLS 1.2 during SAML authentication. This allows an unauthenticated attacker in a Man-in-the-Middle (MitM) position to downgrade the TLS handshake to a deprecated protocol (e.g., TLS 1.0 or 1.1). While the EPSS score is 0.0% (indicating low exploitation likelihood), the vulnerability weakens the security posture of SAML-based authentication flows. The vendor has released a fix in version 7.0.209.

Supply Chain & Package Security

This vulnerability affects the psPAS PowerShell module, which is distributed via the PowerShell Gallery. Organizations using this module should verify they are running version 7.0.209 or later. The module is not an open-source package manager (NPM, PyPI, Go, Ruby) but is a PowerShell module; however, supply chain risks apply if the module is obtained from untrusted sources or if dependencies are compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: High (requires MitM position)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential exposure of SAML response data)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. Exploitation requires an active MitM position and the ability to manipulate TLS handshakes. The impact is limited to potential disclosure of SAML response data.

Deep Dive & Mechanics

The Get-PASSAMLResponse function in the psPAS module is responsible for handling SAML authentication responses from CyberArk. The vulnerability arises because the function does not explicitly set the SecurityProtocol property to Tls12 before making HTTPS requests. By default, .NET may negotiate the highest mutually supported protocol, but an attacker can force a downgrade by interfering with the TLS handshake.

Attack Flow:

1. The attacker positions themselves in the network path between the psPAS client and the CyberArk server (e.g., via ARP spoofing, rogue Wi-Fi, or compromised router).
2. The attacker intercepts the TLS handshake and manipulates the ClientHello message to suggest only deprecated protocols (e.g., TLS 1.0).
3. If the server supports deprecated protocols, the connection is downgraded.
4. The attacker can then decrypt or tamper with the SAML response, potentially extracting authentication tokens or credentials.

Root Cause: Missing explicit [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 in the function.

Vulnerable vs. Patched Code

Vulnerable Code (psPAS < 7.0.209):

function Get-PASSAMLResponse {
    param([string]$SAMLResponse)
    # No explicit TLS enforcement
    $webRequest = [System.Net.WebRequest]::Create($url)
    # ... rest of function
}

Patched Code (psPAS >= 7.0.209):

function Get-PASSAMLResponse {
    param([string]$SAMLResponse)
    # Explicitly enforce TLS 1.2
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $webRequest = [System.Net.WebRequest]::Create($url)
    # ... rest of function
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• MitM position (e.g., ARP spoofing on local network)
• Python with scapy and mitmproxy or bettercap
• Target running psPAS < 7.0.209

Steps:

1. Set up ARP spoofing to intercept traffic between the victim and CyberArk server.
2. Use a TLS downgrade proxy (e.g., tls-downgrade or custom script) to force TLS 1.0.
3. Capture the SAML response using Wireshark or a proxy.
4. Extract authentication tokens from the decrypted SAML response.

Example Python script for TLS downgrade (conceptual):

# This is a simplified example; real implementation requires a full TLS proxy
import socket
import ssl

def downgrade_tls(client_socket):
    # Force TLS 1.0
    context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
    context.verify_mode = ssl.CERT_NONE
    server_socket = context.wrap_socket(client_socket, server_side=False)
    return server_socket

Blue Team

Detection:

• Monitor for TLS 1.0/1.1 handshakes in network logs.
• Alert on SecurityProtocol changes in PowerShell logs (Event ID 4104).
• Use the YARA and Sigma rules below.

Hunting:

• Search for PowerShell scripts that call Get-PASSAMLResponse without explicit TLS enforcement.
• Check for unusual TLS versions in SAML-related traffic.

Indicators of Compromise (IOCs)

• Network: TLS handshakes using TLS 1.0 or 1.1 to CyberArk servers.
• Host: PowerShell script containing Get-PASSAMLResponse without [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12.
• Logs: Event ID 4104 with script block containing Get-PASSAMLResponse and no TLS enforcement.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_psPAS_SAML {
    meta:
        description = "Detects psPAS PowerShell scripts missing TLS 1.2 enforcement in Get-PASSAMLResponse"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-59270"
    strings:
        $func = "Get-PASSAMLResponse" nocase
        $tls = "SecurityProtocol" nocase
        $tls12 = "Tls12" nocase
    condition:
        $func and not ($tls and $tls12)
}

Sigma Rule

title: Detect Missing TLS 1.2 Enforcement in psPAS SAML Function
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects PowerShell scripts using Get-PASSAMLResponse without explicit TLS 1.2 enforcement.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    category: ps_script
detection:
    selection:
        ScriptBlockText|contains: 'Get-PASSAMLResponse'
    filter:
        ScriptBlockText|contains: 'Tls12'
    condition: selection and not filter
falsepositives:
    - Scripts that set TLS globally elsewhere
level: medium

Suricata Rule

alert tls any any -> any any (msg:"CVE-2025-59270 - TLS Downgrade to Deprecated Protocol"; tls.version:<=0x0301; flow:to_server; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update psPAS to version 7.0.209 or later.
• If immediate update is not possible, manually add [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 at the beginning of any script using Get-PASSAMLResponse.

Long-term:

• Enforce TLS 1.2 at the system level via Group Policy or registry.
• Monitor for deprecated TLS versions in network traffic.
• Implement certificate pinning for SAML endpoints.

Workaround:

• Use a network firewall to block TLS 1.0/1.1 traffic to CyberArk servers.

Valters IT