Critical Vulnerability in Netwrix Password Manager Enables Authenticated Remote Code Execution

A critical security vulnerability has been identified in Netwrix Password Secure, a widely used enterprise password management solution, which may allow authenticated attackers to execute remote code on other users' systems.

This vulnerability affects versions up to 9.2.2, including build 9.2.0.32454, for both client (PSC) and server (PSS) components. It poses a significant risk to organizations using the software for secure credential management.

Disclosed by security researchers from 8com on Thu, May 22, 2025, the flaw originates from a weakness in the application's document-sharing functionality, which can be exploited to run malicious payloads under certain conditions.

The issue arises from how Netwrix Password Secure manages document links shared among users. Researchers found that the DocumentsHelper class contains a method called OpenInDefaultProgram , which executes files using the default program associated with their extension via a ProcessFileInfo object.

Although the software enforces a whitelist of allowed file types (e.g., PDF, DOCX, PNG) during initial uploads to prevent direct uploads of executable files like .exe, a bypass exists when modifying document links. The application only verifies the DocumentType attribute against the whitelist, leaving the DocumentPath attribute containing the actual file path unchecked.

This oversight allows attackers to modify the path to point to an executable, such as PowerShell.exe on a local Windows system, while maintaining a benign file type in the system’s metadata.

Netwrix Responds with Patch in Latest Versions

The vulnerability becomes particularly dangerous due to the DocumentParams attribute, which allows parameters to be passed to the executing program without additional validation. By setting a malicious payload in this field and redirecting the file path to PowerShell.exe, researchers successfully executed arbitrary code when a user interacted with the tampered document link.

This attack requires user interaction and authenticated access but can be executed discreetly, especially through shared links or desktop shortcuts that obscure the malicious file path from the victim. An alternative attack scenario involves pointing to executables on accessible network shares.

Netwrix was notified of the vulnerability on Tue, Jan 28, 2025, by the 8com team, with a proof of concept provided shortly after. Confirmation was received on Tue, Feb 11, 2025, leading to the release of a fix in versions above 9.2.2. An official advisory (ADV-2025-009) was published on Tue, Apr 1, 2025, urging users to update immediately.

Organizations using affected versions are strongly advised to patch their systems to mitigate the risk of authenticated remote code execution, which could lead to unauthorized access or data breaches. This incident highlights the importance of rigorous input validation and secure file-handling mechanisms in software designed to protect sensitive information.

Based on reporting by GBHackers.