CVE-2025-54392
📋 TL;DR
Netwrix Directory Manager (formerly Imanami GroupID) versions 11.0.0.0 through 11.1.25162.02 contain a cross-site scripting (XSS) vulnerability in authentication error handling. This allows attackers to inject malicious scripts that execute in victims' browsers when they view authentication error pages. Organizations using vulnerable versions of this directory management software are affected.
💻 Affected Systems
- Netwrix Directory Manager (formerly Imanami GroupID)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, or redirect users to malicious sites, potentially leading to full system compromise.
Likely Case
Session hijacking, credential theft, or defacement of authentication error pages through injected content.
If Mitigated
Limited impact with proper input validation and output encoding in place; attackers could only execute scripts in specific error contexts.
🎯 Exploit Status
Requires user interaction (viewing crafted error page); no authentication needed to trigger the vulnerable error condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.1.25162.02 or later
Vendor Advisory: https://community.netwrix.com/t/adv-2025-015-critical-vulnerabilities-in-netwrix-directory-manager-formerly-imanami-groupid-v11/17192
Restart Required: No
Instructions:
1. Download the latest patch from Netwrix support portal. 2. Apply the patch following vendor instructions. 3. Verify the version is 11.1.25162.02 or higher.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall rules to filter malicious script patterns in authentication error parameters.
WAF-specific configuration required
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Monitor authentication logs for suspicious error patterns
🔍 How to Verify
Check if Vulnerable:
Check the installed version against the vulnerable range; test authentication error pages with safe XSS payloads.Check Version:
Check application interface or installation directory for version informationVerify Fix Applied:
Confirm version is 11.1.25162.02 or later; test that script injection no longer executes in authentication error responses.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication error patterns
- Requests containing script tags or JavaScript in authentication parameters
Network Indicators:
- HTTP requests with script payloads in authentication error parameters
SIEM Query:
source="netwrix" AND (error AND (script OR javascript OR <script>))