ITM Server Missing Authorization for URL validation

Vulnerability

A missing authorization check in multiple URL validation endpoints of the Insider Threat Management Server allows an anonymous attacker on an adjacent network to smuggle content via DNS lookups. All versions before 7.14.3 are affected.

Exploitation

An attacker with network access to the adjacent network (e.g., same broadcast domain or local subnet) can send crafted DNS lookups to the vulnerable endpoints without any authentication. The exact sequence of steps is not publicly detailed, but the lack of authorization enables the smuggling of arbitrary content through DNS responses.

Impact

Successful exploitation allows the attacker to smuggle content via DNS lookups, which could lead to information disclosure or injection of malicious data into the server's processing pipeline. The attacker gains the ability to manipulate DNS-related data without proper authorization.

Mitigation

Proofpoint released fixed software version 7.14.3 on June 27, 2023, which addresses this vulnerability [1]. Users should upgrade to 7.14.3 or later. No workarounds have been published.