CVE-2020-10655

Vulnerability

The vulnerability resides in the WriteWindowMouse API of the Proofpoint Insider Threat Management Server (formerly ObserveIT Server) application server. It is caused by improper deserialization of attacker-supplied data. All versions before 7.9.1 are affected [1][2].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication. No user interaction or special network position is required; the attacker simply sends a specially crafted request to the vulnerable API endpoint. This triggers the improper deserialization, leading to arbitrary code execution [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code with local administrator privileges. This results in a complete compromise of confidentiality, integrity, and availability, as the attacker gains full control over the affected server [1][2].

Mitigation

Proofpoint released version 7.9.1 on May 11, 2020, which fixes the vulnerability. Customers still running an earlier version should update immediately. No workaround is documented; upgrading to the fixed version is the only mitigation [2].