---
Updated: June 2024
CVE: CVE-2025-22274
Product Affected: CyberArk Endpoint Privilege Manager SaaS version 24.7.1
Issue: HTML Injection via "content" field on Application definition page
Disclosure Status: Vendor unreachable after repeated attempts
Written by: [Your Name/Handle] (Exclusive long-read)
Overview
A new security flaw, CVE-2025-22274, has been discovered in CyberArk Endpoint Privilege Manager (EPM) SaaS version 24.7.1. This vulnerability lets attackers inject arbitrary HTML into the management interface by abusing the "content" field on the 'Application definition' page.
This write-up explains exactly how the vulnerability works, provides a straightforward reproduction guide, contains proof of concept code, and discusses real-world risks. We’ll also highlight the lack of vendor response and point you to the best references for tracking updates.
What Is HTML Injection?
HTML Injection is similar to Cross-Site Scripting (XSS), but typically uses a site’s own functionality to insert malicious HTML code into rendered pages, leading to issues like UI defacement, session manipulation, or further XSS. Today’s exploit demonstrates this in a real-life enterprise SaaS setting.
Vulnerable Feature
The vulnerable parameter is "content" found on the "Application definition" configuration page in CyberArk EPM SaaS 24.7.1. There is no input sanitization, so any HTML provided by an attacker will be rendered verbatim when viewing the application definition.
Impact
- Attackers can inject HTML or script code that is executed in the browser of any user who views the affected page.
- Potential for phishing, credential harvesting, privilege escalation (if chained with other bugs), or full XSS.
Exploit: Step-by-Step & Code Snippet
Here’s how you can validate and reproduce the vulnerability (for educational/defensive purposes only):
Navigate to: *Applications* > *Add New Application*.
3. In the “content” or “description” field (label may vary), carefully insert your HTML payload. For example:
<b>Welcome</b><script>alert('CVE-2025-22274');</script>
Save your application definition.
5. Reopen or view the newly created application entry. The browser should render your HTML. If you included the <script> tag, you may see the alert popup. Tags like <iframe>, <img onerror=...>, etc. also work, confirming the unsafe handling.
Proof of Concept (Screenshot Example)
*(Replace with your own environment’s UI screenshot as appropriate!)*
<b>Compromised by CVE-2025-22274</b>
<img src="#" onerror="alert('EPM HTML Injection!')">
Result:
*Screenshot shows HTML/JS rendered in the Application definition section.*
`html
Alert: Test
`html
`html
`html
Exploit Analysis
The core mistake is that user-supplied content is included in the page without escaping or filtering. This means any HTML/JS entered will be executed by the browser. If used by malicious or compromised users, this exposure opens the door to further attacks (such as session hijack, credential theft, UI redress, etc.).
Phishing: Injecting login forms or buttons that send credentials to an attacker.
- Persistence: Hidden payloads (images/scripts) can re-infect or annoy legitimate users.
Privilege Abuse: Trick higher-privileged admins into running malicious JS.
- Data Leaks: Exfiltration of sensitive browser/session data.
Segregate users to minimize the impact of compromised accounts.
No official patch or workaround currently exists, as CyberArk has not responded to responsible disclosure attempts (see disclosure timeline below).
References
- CyberArk EPM Official Docs
- CVE Report (Mitre)
- OWASP XSS Cheat Sheet
Closing Notes
Until a patch is released, treat all input fields on the Application definition page as untrusted. Double check content, monitor logs for script injection attempts, and advocate for secure coding practices.
If you are a customer, contact CyberArk support referencing this CVE and urge them to address HTML/JS injection vulnerabilities as soon as possible. Community-driven awareness is our best defense when vendors are unresponsive!
Stay safe—and responsibly report what you find.
If you liked this exclusive deep dive or have more info on EPM security, let us know in the comments or via DM. Share responsibly!
Timeline
Published on: 02/28/2025 13:15:28 UTC
Last modified on: 03/05/2025 16:15:38 UTC