CVE-2018-9022

Vulnerability

CVE-2018-9022 is an authentication bypass vulnerability in CA Privileged Access Manager (formerly Xceedium Xsuite) versions 2.8.2 and earlier. The flaw resides in the handling of configuration files; by poisoning a configuration file, a remote attacker can bypass authentication mechanisms and execute arbitrary code or commands. No authentication or prior access is required for the vulnerable code path to be reached.

Exploitation

An attacker with network access to the affected CA Privileged Access Manager appliance can poison a configuration file. The specific technique is not publicly detailed, but the attack does not require valid credentials or user interaction. The attacker sends crafted input that corrupts the configuration data, allowing them to inject commands or code.

Impact

Successful exploitation grants the attacker arbitrary code execution with the privileges of the application. This can lead to full compromise of the PAM appliance, enabling the attacker to intercept, modify, or steal privileged credentials and sessions managed by the system, as well as pivot to other network resources.

Mitigation

CA Technologies released a security notice [1] on June 14, 2018, but did not provide a specific fixed version. The recommended action is to upgrade to a version newer than 2.8.2. For the latest details, customers should consult the vendor advisory and apply available patches. No workaround is documented.