-
-
Notifications
You must be signed in to change notification settings - Fork 100
Open
Description
Describe the issue
From some basic testing and reverse engineering it appears that psPas leaks password to the eventlog when Windows logging (without Protected Event Logging) is enabled.
See also: https://stackoverflow.com/q/79877875/1701026
To Reproduce
Steps to reproduce the behavior:
- Enable Windows Logging
- Run a command as:
New-PASSession -Credential $SACredential -BaseUri $BaseUri - Search the eventlog for e.g.
Invoke-PASRestMethod(or your password)
Expected behavior
Passwords to be kept secret
Screenshots & Console Output
Eventlog snippet:
ParameterBinding(Invoke-PASRestMethod): name="Body"; value="{
"password": "Plain-Text Password",
"username": "Username"
}"Your Environment
- PowerShell Version:
Name Value
---- -----
PSVersion 5.1.14393.8781
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.14393.8781
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
- psPAS Version:
5.2.59(not sure if the issue also exists in the latest version) - CyberArk Version:
14.6.1 (14.6.1.77)
Additional context
Metadata
Metadata
Assignees
Labels
No labels