DLP Endpoint ePO extension not sanitizing CSV exports

The primary impact of CVE-2019-3595 is the potential for arbitrary code execution on the administrator's machine. An attacker, posing as an authenticated administrator, can craft a malicious DLP policy, export it, and trick the administrator into opening it. Upon execution, the policy will inject and execute commands, granting the attacker control over the system with the administrator's privileges. This could lead to data theft, system compromise, or further lateral movement within the network. The requirement for explicit user approval to execute the code slightly mitigates the risk, but social engineering tactics could still be effective.

Organizations utilizing McAfee Data Loss Prevention (DLP) Endpoint ePO extension in versions 11.0.0 through 11.3.0 are at risk. This includes environments with a high number of administrators with access to the ePO console, as well as those with less stringent DLP policy review processes. Shared hosting environments utilizing the extension are also potentially vulnerable.

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*DLP*'} | Select-Object TaskName, State, LastRunTime

• windows / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*epo*'} | Select-Object ProcessName, Id, CPU, WorkingSet

• windows / supply-chain: Check registry for suspicious entries related to DLP policies under HKLM\SOFTWARE\McAfee\DLP\Policies.

1. 2019-07-24Disclosure

   disclosure

1. Reservado2019-01-03
2. Publicada2019-07-24
3. Modificada2024-08-04
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2019-3595 is to upgrade the McAfee DLP Endpoint ePO extension to version 11.3.0 or later. Prior to upgrading, it is recommended to create a backup of the existing ePO configuration. If an upgrade is not immediately feasible, restrict administrator access to the ePO extension and closely monitor DLP policy exports for any suspicious activity. Consider implementing stricter DLP policy review processes to identify and prevent the deployment of malicious policies. There are no specific WAF or proxy rules that can directly address this vulnerability.