ITM Server Communications Hijack

Vulnerability

An improper check for an exceptional condition exists in the Insider Threat Management (ITM) Server, as described in the Proofpoint security advisory [1]. This flaw allows an attacker who has already obtained valid agent credentials and the agent hostname to change the configuration of any already-registered agent. All versions prior to 7.14.3.69 are affected [1].

Exploitation

An attacker must first successfully obtain valid agent credentials and the agent hostname [1]. With these, the attacker can exploit the improper check to modify the agent's configuration, causing the agent to send all future communications to an attacker-chosen URL [1]. No additional privileges or user interaction beyond the credential theft is required.

Impact

Successful exploitation enables the attacker to intercept sensitive data events from the agent, including personally identifiable information (PII) and intellectual property that the agent monitors. Furthermore, the attacker can alter or delete all such data before it reaches the ITM Server, leading to confidentiality, integrity, and availability impacts [1].

Mitigation

Proofpoint has released version 7.14.3.69 to fix this vulnerability [1]. Users should upgrade to this version or later. No workarounds have been disclosed. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the last check.