CVE-2019-7442
📋 TL;DR
This XXE vulnerability in CyberArk Password Vault Web Access allows attackers to read arbitrary files from the server or potentially bypass authentication by exploiting the SAML authentication system. It affects CyberArk Enterprise Password Vault versions 10.7 and earlier. Remote attackers can exploit this without authentication.
💻 Affected Systems
- CyberArk Enterprise Password Vault
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the password vault with credential theft, privilege escalation, and potential lateral movement across the network.
Likely Case
Unauthorized access to sensitive files containing credentials, configuration data, or authentication bypass leading to privilege escalation.
If Mitigated
Limited impact with proper network segmentation, file system permissions, and external entity processing disabled.
🎯 Exploit Status
Public exploit code exists showing file read capabilities. Authentication bypass potential mentioned but not fully demonstrated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.8 and later
Vendor Advisory: https://www.cyberark.com/resources/threat-research-blog/cyberark-password-vault-web-access-xxe-vulnerability
Restart Required: Yes
Instructions:
1. Upgrade to CyberArk Enterprise Password Vault version 10.8 or later. 2. Apply all security patches from CyberArk. 3. Restart the PVWA service after upgrade.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure XML parser to disable external entity resolution
Set XML parser properties: FEATURE_SECURE_PROCESSING = true, DISALLOW_DOCTYPE_DECL = true
Network segmentation
allRestrict access to PVWA interface
Firewall rules to limit PVWA access to trusted IPs only
🧯 If You Can't Patch
- Implement strict network access controls to limit PVWA exposure
- Monitor for unusual XML parsing activity and file access patterns
🔍 How to Verify
Check if Vulnerable:
Check CyberArk version via PVWA interface or installation directory. Versions <=10.7 are vulnerable.Check Version:
Check PVWA web interface or installation logs for version informationVerify Fix Applied:
Verify version is 10.8 or later and test XML parsing with external entities disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- File access attempts via XML entities
- SAML authentication failures with malformed XML
Network Indicators:
- HTTP requests with XML containing external entity references
- Outbound connections from PVWA to internal file shares
SIEM Query:
source="pvwa" AND (xml OR xxe OR "DOCTYPE" OR "ENTITY")🔗 References
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/
- http://packetstormsecurity.com/files/152801/CyberArk-Enterprise-Password-Vault-10.7-XML-External-Entity-Injection.html
- https://www.octority.com/2019/05/07/cyberark-enterprise-password-vault-xml-external-entity-xxe-injection/
