CVE-2022-36121

Vulnerability

An issue in Blue Prism Enterprise versions 6.0 through 7.01 allows an authenticated user to reverse engineer the software and circumvent access controls for the UpdateOfflineHelpData administrative function. This function, intended for updating the offline help URL, can be abused in misconfigured environments where the Blue Prism Application server is exposed. The vulnerability requires that the attacker has valid credentials and network access to the server.

Exploitation

An attacker with authenticated access to the Blue Prism Application server can reverse engineer the application to identify and call the UpdateOfflineHelpData function without proper authorization. By setting the offline help URL to a malicious address, the attacker can spoof the help page or point to a local file. No additional user interaction is required beyond the initial authentication.

Impact

Successful exploitation allows the attacker to change the offline help URL to any location of their choice. This can lead to spoofing of the help page, potentially tricking users into revealing sensitive information, or executing a local file, which could result in information disclosure or further compromise of the system.

Mitigation

Blue Prism has released security patches for all versions starting from 6.4, and the fix is incorporated into version 7.1 [2]. Customers are urged to upgrade to a patched version. As a workaround, implementing the Blue Prism Robotic Operating Model (ROM) practices—such as logically securing the network, limiting access to approved devices, and allow-listing connections—can reduce the likelihood of exploitation. Cloud customers are not affected and require no action [2].