ITM Server Missing Authorization in SOAP Endpoints

Vulnerability

A missing authorization check in multiple SOAP endpoints of the Insider Threat Management Server allows an attacker on an adjacent network to read and write unauthorized objects. Successful exploitation requires an attacker to first obtain a valid agent authentication token. All versions before 7.14.3 are affected [1].

Exploitation

An attacker must be on an adjacent network and have obtained a valid agent authentication token. No additional privileges or user interaction are required beyond the token. The attacker then sends crafted SOAP requests to the vulnerable endpoints to read or write unauthorized objects [1].

Impact

Successful exploitation enables an unauthenticated attacker to read and write unauthorized objects on the server, leading to potential disclosure of sensitive information or modification of server data. The attacker does not gain full administrative control but can access and alter objects they should not have permission to [1].

Mitigation

Proofpoint has released fixed software version 7.14.3, available through the customer support portal [1]. Users should upgrade to this version or later. No workarounds are mentioned in the reference. Agents for MacOS, Linux, and Cloud are unaffected [1].