CVE-2025-46067
📋 TL;DR
A vulnerability in Automai Director v.25.2.0 allows remote attackers to escalate privileges and access sensitive information by uploading a malicious JavaScript file. This affects organizations using Automai Director for automation and RPA workflows. Attackers can potentially gain administrative control over the system.
💻 Affected Systems
- Automai Director
📦 What is this software?
Director by Automai
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, data exfiltration, and lateral movement across connected systems.
Likely Case
Privilege escalation leading to unauthorized access to sensitive automation data, credentials, and business process information.
If Mitigated
Limited impact with proper file upload restrictions and privilege separation in place.
🎯 Exploit Status
Exploit requires file upload capability. The GitHub gist shows proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.automai.com/
Restart Required: No
Instructions:
Check Automai website for security updates. No official patch confirmed as of analysis date.
🔧 Temporary Workarounds
Restrict JavaScript file uploads
allBlock upload of .js files through web application firewall or server configuration
Implement strict file type validation
allValidate file extensions and MIME types before accepting uploads
🧯 If You Can't Patch
- Isolate Automai Director systems from internet and restrict internal network access
- Implement strict access controls and monitor for suspicious file upload activities
🔍 How to Verify
Check if Vulnerable:
Check Automai Director version in administration panel or configuration filesCheck Version:
Check Automai Director web interface or consult installation documentationVerify Fix Applied:
Verify version is updated beyond v.25.2.0 and test file upload restrictions📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads, especially .js files
- Privilege escalation attempts in audit logs
Network Indicators:
- Unexpected outbound connections from Automai Director
- File upload requests to Automai endpoints
SIEM Query:
source="automai" AND (file_upload="*.js" OR privilege_change="admin")