BMC Control-M/Agent Pfadüberschreitung lokale Privilegieneskalation

Successful exploitation of this path traversal vulnerability could allow an attacker to read or write files outside of the intended directory, potentially gaining access to sensitive system data or executing arbitrary code. The attacker needs to have existing access to the system hosting the Control-M/Agent. This could involve compromised user accounts or other vulnerabilities that provide initial foothold. The potential impact includes data breaches, system compromise, and disruption of Control-M operations. While the description doesn't explicitly mention it, the ability to write files could lead to code execution, significantly expanding the attack surface.

Organizations running Control-M/Agent, particularly those using older, out-of-support versions (9.0.18 – 9.0.21) and those with limited access controls on the Agent system, are at significant risk. Shared hosting environments where multiple users share the same system are also particularly vulnerable.

• linux / server: Monitor system logs (journalctl) for unusual file access patterns, particularly attempts to access files outside of the expected Agent directory. Use lsof to identify processes accessing sensitive files. • windows / supply-chain: Use PowerShell to monitor for unusual process execution or file access. Example: Get-Process | Where-Object {$_.Path -like 'Control-M/Agent'} | Select-Object ProcessName, Path • generic web: Examine web server access logs for requests containing suspicious path traversal sequences (e.g., ../..).

1. 2025-09-16Disclosure

   disclosure

1. Reserviert2025-08-07
2. Veröffentlicht2025-09-16
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-55115 is to upgrade the Control-M/Agent to version 9.0.20.100 or later. If an immediate upgrade is not feasible, consider restricting access to the Agent's directory and implementing strict file permissions to limit the potential impact of a successful attack. Review and harden the system's overall security posture, including user account management and network segmentation. There are no specific WAF or proxy rules that can directly address this path traversal vulnerability; the focus should be on restricting access and patching the vulnerable component. After upgrade, confirm the fix by attempting to access files outside the intended directory and verifying that access is denied.