CVE-2022-36117

Vulnerability

This issue exists in Blue Prism Enterprise versions 6.0 through 7.01. In a misconfigured environment exposing the Blue Prism Application server, an authenticated user can reverse-engineer the software and circumvent access controls for an administrative function. The vulnerability is described in the CVE description [1][2].

Exploitation

The attacker must have authenticated access to a misconfigured Blue Prism Application server. If credential access is configured to be accessible by a machine or the runtime resource security group, the attacker can use reverse engineering to spoof a known machine and request known encrypted credentials. The vendor notes that exploitation requires several complex pre-requisites, including that the Blue Prism platform components are not set up in a logically secured network as recommended [2].

Impact

Upon successful exploitation, an attacker can obtain encrypted credentials and later decrypt them. This leads to disclosure of sensitive credentials, potentially compromising the Blue Prism environment and the systems it controls. The vendor rates the potential impact as critical but notes a low probability of exploitation due to the strict prerequisites [2].

Mitigation

SS&C Blue Prism has incorporated patches into version 7.1, which is the latest release and can be downloaded from the vendor. Patches are also being prepared for versions starting at 6.4. Cloud customers are not affected because the cloud platform follows security best practices. The recommended workaround is to follow the Blue Prism Robotic Operating Model (ROM) practices, including logical network segmentation and allow-listing connections [2].