CVE-2023-5444: McAfee ePO CSRF Vulnerability

CVE-2023-5444 Overview

A Cross-Site Request Forgery (CSRF) vulnerability exists in McAfee ePolicy Orchestrator (ePO) prior to version 5.10.0 CP1 Update 2. This vulnerability allows a remote attacker with low privileges to successfully add a new user with administrator privileges to the ePO server. The vulnerability specifically impacts the dashboard area of the user interface and requires the attacker to manipulate the HTTP payload post-submission before it reaches the ePO server.

Critical Impact

Successful exploitation enables unauthorized privilege escalation, allowing attackers to create administrator accounts on the ePO server, potentially compromising the entire endpoint security management infrastructure.

Affected Products

• McAfee ePolicy Orchestrator versions prior to 5.10.0 CP1 Update 2
• McAfee ePolicy Orchestrator 5.10.0 Service Pack 1 Update and Update 1
• McAfee ePolicy Orchestrator 5.10.0 Update 1 through Update 15

Discovery Timeline

• 2023-11-17 - CVE-2023-5444 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-5444

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability (CWE-352) resides in the dashboard area of the McAfee ePolicy Orchestrator web interface. The ePO server fails to properly validate the origin of sensitive state-changing requests, specifically those related to user account management. This architectural weakness allows an authenticated attacker with low-level privileges to craft malicious requests that, when executed in the context of an administrator's session, can create new administrator accounts.

The vulnerability requires user interaction—an administrator must be tricked into executing the forged request, typically through social engineering techniques such as clicking a malicious link or visiting a compromised webpage while authenticated to the ePO server.

Root Cause

The root cause of this vulnerability is the absence of proper anti-CSRF token validation in the user management functionality of ePolicy Orchestrator. The application fails to implement adequate request validation mechanisms to verify that state-changing requests originate from legitimate user sessions. This allows attackers to craft requests that bypass authentication checks when executed in an administrator's browser context.

Attack Vector

The attack follows a network-based vector requiring authenticated access to the ePO environment. The exploitation process involves:

1. The attacker, possessing low-privilege access to the ePO system, crafts a malicious HTTP request designed to create a new administrator account
2. The attacker intercepts and modifies the HTTP payload post-submission, before it reaches the ePO server
3. The manipulated request exploits the CSRF vulnerability to execute privileged operations
4. Upon successful execution, a new user with administrator privileges is added to the ePO server

The attack targets the dashboard area of the user interface, which handles user management functions without proper CSRF protections.

Detection Methods for CVE-2023-5444

Indicators of Compromise

• Unexpected administrator account creation in ePO server audit logs
• Unusual HTTP POST requests to user management endpoints from external or untrusted sources
• Evidence of intercepted or modified HTTP payloads in network traffic logs
• New user accounts with elevated privileges created without corresponding legitimate administrative actions

Detection Strategies

• Monitor ePO audit logs for unauthorized user creation events, particularly accounts with administrator privileges
• Implement network monitoring to detect anomalous HTTP traffic patterns targeting the ePO dashboard interface
• Configure alerting for privilege escalation events within the ePolicy Orchestrator environment
• Review web server logs for suspicious POST requests to user management endpoints

Monitoring Recommendations

• Enable comprehensive logging for all user account management activities in ePolicy Orchestrator
• Deploy web application firewall (WAF) rules to detect and block potential CSRF attack patterns
• Implement session monitoring to identify suspicious administrator session activity
• Establish baseline behavior for ePO administrative operations to facilitate anomaly detection

How to Mitigate CVE-2023-5444

Immediate Actions Required

• Update McAfee ePolicy Orchestrator to version 5.10.0 CP1 Update 2 or later immediately
• Audit existing ePO user accounts for any unauthorized administrator accounts
• Review audit logs for evidence of exploitation prior to patching
• Implement network segmentation to limit access to ePO management interfaces

Patch Information

McAfee (now Trellix) has released a security update to address this vulnerability. Organizations should upgrade to ePolicy Orchestrator version 5.10.0 CP1 Update 2 or later. Detailed patch information and download links are available in the Trellix Security Advisory SB10410.

Workarounds

• Restrict network access to the ePO management interface to trusted administrator workstations only
• Implement multi-factor authentication for ePO administrative access
• Deploy a web application firewall with CSRF protection rules in front of the ePO server
• Educate administrators about social engineering risks and the importance of not clicking untrusted links while authenticated to ePO

# Configuration example - Restrict ePO access via firewall
# Allow access to ePO management port only from trusted admin network
iptables -A INPUT -p tcp --dport 8443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP