CVE-2020-25738 : Security Advisory and Response

CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has credential access, such as a Chrome process that reads credentials from a SQLite database.

Understanding CVE-2020-25738

This CVE identifies a vulnerability in CyberArk Endpoint Privilege Manager (EPM) version 11.1.0.173 that enables attackers to circumvent a security mechanism designed to prevent Credential Theft.

What is CVE-2020-25738?

The vulnerability in CyberArk EPM 11.1.0.173 allows malicious actors to inject a DLL into a process with credential access, like Chrome, to bypass the Credential Theft protection.

The Impact of CVE-2020-25738

This vulnerability can lead to unauthorized access to sensitive credentials stored in processes like Chrome, posing a significant security risk to affected systems.

Technical Details of CVE-2020-25738

CyberArk EPM 11.1.0.173 vulnerability details:

Vulnerability Description

Attackers can inject a DLL into processes with credential access.

Affected Systems and Versions

Product: CyberArk Endpoint Privilege Manager
Version: 11.1.0.173

Exploitation Mechanism

Injection of DLL into processes like Chrome to bypass Credential Theft protection.

Mitigation and Prevention

Steps to address CVE-2020-25738:

Immediate Steps to Take

Update CyberArk EPM to a patched version.
Monitor processes for unusual DLL injections.

Long-Term Security Practices

Implement least privilege access controls.
Regularly review and update security configurations.

Patching and Updates

Apply security patches and updates provided by CyberArk to mitigate the vulnerability.