CVE-2022-25152
📋 TL;DR
CVE-2022-25152 is a critical vulnerability in the ITarian platform that allows authenticated users to bypass mandatory approval processes and execute arbitrary code on all agents. This enables full system takeover of managed endpoints. Any organization using ITarian versions prior to 6.35.37347.20040 is affected.
💻 Affected Systems
- ITarian platform (both SaaS and on-premise deployments)
📦 What is this software?
On Premise by Itarian
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all managed endpoints, allowing attackers to install malware, steal data, pivot to other systems, and maintain persistent access across the entire IT infrastructure.
Likely Case
Attackers with valid credentials can execute arbitrary commands on all managed systems, leading to data exfiltration, ransomware deployment, or lateral movement within the network.
If Mitigated
With proper network segmentation and endpoint protection, impact could be limited to isolated segments, though compromised agents would still be fully controlled by attackers.
🎯 Exploit Status
Exploitation requires a valid session token but is otherwise straightforward. The vulnerability is in the approval bypass mechanism.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.35.37347.20040 and later
Vendor Advisory: https://csirt.divd.nl/CVE-2022-25152
Restart Required: Yes
Instructions:
1. Upgrade ITarian platform to version 6.35.37347.20040 or later. 2. Restart the ITarian service. 3. Verify all agents are updated to compatible versions.
🔧 Temporary Workarounds
Disable procedures feature
allTemporarily disable the procedures functionality until patching can be completed
Implement strict approval workflows
allRequire multiple approvers and implement additional validation for all procedure executions
🧯 If You Can't Patch
- Implement network segmentation to isolate ITarian management traffic
- Enable strict monitoring and alerting for unusual procedure executions
🔍 How to Verify
Check if Vulnerable:
Check ITarian platform version in administration console. If version is below 6.35.37347.20040, the system is vulnerable.Check Version:
Check version in ITarian admin interface or via platform-specific version query commandsVerify Fix Applied:
Verify platform version is 6.35.37347.20040 or higher and test that approval bypass is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unauthorized procedure executions
- Approval bypass attempts
- Unusual procedure creation patterns
Network Indicators:
- Unusual traffic from ITarian server to agents
- Suspicious command execution patterns
SIEM Query:
source="itarian" AND (event_type="procedure_execution" AND approval_status="bypassed")