Netwrix Password Manager Vulnerability Allows Authenticated Remote Code Execution

A critical security vulnerability, identified as CVE-2025-26817, has been discovered in Netwrix Password Secure, an enterprise password management solution. This flaw allows authenticated attackers to execute arbitrary code on victim machines and affects all versions up to 9.2.2.

The vulnerability exists in the document sharing functionality, which is designed to securely share passwords and other sensitive information within an organization. The issue arises from a flaw in how the application validates file types when updating existing document links.

During initial document uploads, the application restricts file types to a whitelist. However, these security checks can be bypassed when modifying existing document links. An authenticated attacker can manipulate document properties to change the file path to point to an executable file while maintaining the original document type in the system.

The vulnerability was identified by 8 COM security researchers during a comprehensive security analysis of the platform. The application fails to verify the complete document path when updating document properties, focusing only on the DocumentType attribute and neglecting to validate changes to the DocumentPath attribute.

Exploitation begins with an attacker creating a legitimate document link using an allowed file type, such as a PDF. After the document is saved to the database, the attacker modifies the DocumentPath attribute to point to PowerShell.exe while leaving the DocumentType unchanged as "pdf".

public void UpdateContainerFileHandle(MtoContainer container, Guid fileHandle) { this.VerifyCorrectDocumentType(container); using (RightManager rm = new RightManager(base.CurrentConnection)) { rm.VerifyObjectRight(container.Id, Rights.RightWrite, true); } }

This method only checks the DocumentType attribute but fails to validate the DocumentPath. The DocumentParams attribute can also be manipulated to include PowerShell commands:

currendContainer.TimeStampUtc = container.TimeStampUtc; currendContainer.DocumentPath = container.DocumentPath; currendContainer.DocumentType = container.DocumentType; currendContainer.DocumentSize = container.DocumentSize; currendContainer.DocumentMeta = container.DocumentMeta; currendContainer.DocumentParams = container.DocumentParams; currendContainer.DocumentCacheDeleteTime = container.DocumentCacheDeleteTime; currendContainer.EntityState = MtoEntityState.Modified;

When a victim user opens the shared document link, the system executes PowerShell with the attacker-controlled parameters rather than opening the expected PDF file.

Exploitation enables remote code execution in the context of the victim's user account. Netwrix has addressed this vulnerability in versions above 9.2.2, and users are strongly advised to update immediately.

The vulnerability was responsibly disclosed with initial contact made on Tue, Jan 28, 2025, and public disclosure occurring on Thu, May 22, 2025, after remediation was available.

Based on reporting by Cyber Security News.