CVE-2022-33752
📋 TL;DR
CVE-2022-33752 is a critical remote code execution vulnerability in CA Automic Automation agents due to insufficient input validation. Attackers can exploit this to execute arbitrary code on affected systems. Organizations using CA Automic Automation 12.2 or 12.3 are vulnerable.
💻 Affected Systems
- CA Automic Automation
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the Automic agent host, potentially leading to lateral movement across the network and data exfiltration.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or disrupt automation workflows.
If Mitigated
Limited impact if network segmentation and strict access controls prevent unauthorized access to Automic agents.
🎯 Exploit Status
The vulnerability requires network access to the Automic agent but no authentication, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches from Broadcom security advisory
Vendor Advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20629
Restart Required: Yes
Instructions:
1. Download the security patch from Broadcom support portal. 2. Apply the patch to all affected Automic Automation installations. 3. Restart Automic agents and services. 4. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Automic agents to only trusted IP addresses and networks.
Firewall Rules
allImplement firewall rules to block unauthorized access to Automic agent ports.
🧯 If You Can't Patch
- Isolate affected systems in a separate network segment with strict access controls.
- Implement application-level firewalls or WAF rules to filter malicious input to Automic agents.
🔍 How to Verify
Check if Vulnerable:
Check Automic Automation version via administrative console or configuration files. Versions 12.2 and 12.3 are vulnerable.Check Version:
Check version in Automic administrative interface or configuration files (specific command varies by deployment).Verify Fix Applied:
Verify patch installation through version check and test agent functionality. Monitor for any abnormal behavior.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Automic agent
- Failed authentication attempts to agent services
- Abnormal network connections to agent ports
Network Indicators:
- Unexpected traffic to Automic agent ports (default 2210)
- Suspicious payloads in network traffic to agents
SIEM Query:
source="automic_agent" AND (event_type="process_execution" OR event_type="network_connection") AND severity=HIGH