CVE-2022-36115

Vulnerability

An issue in Blue Prism Enterprise versions 6.0 through 7.01 allows an authenticated user to reverse engineer the software and circumvent access controls. The vulnerability resides in the CreateProcessAutosave() method, which can be abused to inject custom functionality into a development process. This requires a misconfigured environment where the Blue Prism Application server is exposed.

Exploitation

An attacker with authenticated access to the misconfigured Blue Prism Application server can use the CreateProcessAutosave() method to inject malicious code into a development process. If a user, upon a warning, chooses to recover unsaved work by using the last saved version, the injected code enters the workflow. If the process action stages are not fully reviewed before publishing, the malicious code can be executed in a production environment.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the production environment, potentially compromising the integrity and confidentiality of Blue Prism processes and data. The attacker gains the ability to run malicious workflows with the privileges of the Blue Prism service.

Mitigation

SS&C Blue Prism has released security patches for versions starting at 6.4, with the fixes incorporated in version 7.1 [2]. Cloud customers are not affected. As a workaround, implementing the Blue Prism Robotic Operating Model (ROM) practices—such as logical network segregation, restricted access to approved devices, and allow-listing connections—reduces the likelihood of exploitation [2].