CVE-2022-36115 : What You Need to Know

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01 where a misconfigured environment could expose the Blue Prism Application server to potential exploitation. This could allow authenticated users to reverse engineer the software, leading to unauthorized access and injection of malicious code into development processes.

Understanding CVE-2022-36115

This CVE highlights a critical vulnerability in Blue Prism Enterprise versions 6.0 through 7.01 that could result in the injection of malicious code into workflows, potentially compromising the production environment.

What is CVE-2022-36115?

The vulnerability in Blue Prism Enterprise versions 6.0 through 7.01 exposes the software to reverse engineering by authenticated users, enabling them to bypass access controls and inject malicious code into the development process.

The Impact of CVE-2022-36115

If exploited, attackers could inject unauthorized code into workflows during development. This could lead to the execution of malicious functionality in a production environment if not thoroughly reviewed before deployment.

Technical Details of CVE-2022-36115

This section provides insights into the vulnerability details, affected systems, and the exploitation mechanism.

Vulnerability Description

The issue arises due to a misconfigured environment that allows authenticated users to reverse engineer the Blue Prism software and inject unauthorized functionality into the development process using the CreateProcessAutosave() method.

Affected Systems and Versions

Blue Prism Enterprise versions 6.0 through 7.01 are impacted by this vulnerability, potentially exposing them to exploitation by attackers aiming to insert malicious code.

Exploitation Mechanism

Attackers can abuse the CreateProcessAutosave() method to introduce their own functionality during development. If unsaved work is recovered using the last saved version without thorough review, the injected malicious code could enter the workflow.

Mitigation and Prevention

In response to CVE-2022-36115, immediate actions should be taken to secure affected systems and prevent potential exploitation.

Immediate Steps to Take

It is essential to review and update access controls, thoroughly examine workflow stages before deployment, and restrict access to development environments to authorized personnel only.

Long-Term Security Practices

Implementing secure coding practices, conducting regular security audits, and providing security awareness training to developers can enhance the overall security posture.

Patching and Updates

Blue Prism should release patches or updates that address this vulnerability promptly. Users are advised to apply these patches as soon as they are available to mitigate the risk of exploitation.