CVE-2019-18355 : What You Need to Know

A security vulnerability known as an SSRF issue has been identified in the previous version of Thycotic Secret Server's Web launcher, specifically those released prior to version 10.7.

Understanding CVE-2019-18355

An SSRF issue was discovered in the legacy Web launcher in Thycotic Secret Server before 10.7.

What is CVE-2019-18355?

CVE-2019-18355 is a Server-Side Request Forgery (SSRF) vulnerability found in the Web launcher of Thycotic Secret Server versions prior to 10.7.

The Impact of CVE-2019-18355

This vulnerability could allow an attacker to send crafted requests from the server, potentially leading to unauthorized access to internal resources or services.

Technical Details of CVE-2019-18355

Vulnerability Description

The SSRF issue in Thycotic Secret Server's Web launcher before version 10.7 allows attackers to manipulate server requests.

Affected Systems and Versions

Thycotic Secret Server versions prior to 10.7

Exploitation Mechanism

Attackers can exploit this vulnerability to make the server perform unauthorized requests on behalf of the attacker.

Mitigation and Prevention

Immediate Steps to Take

Upgrade Thycotic Secret Server to version 10.7 or later to mitigate the SSRF vulnerability.
Implement network controls to restrict server access and prevent unauthorized requests.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Conduct security assessments and penetration testing to identify and remediate potential weaknesses.

Patching and Updates

Stay informed about security advisories and updates from Thycotic to apply patches promptly.