Skip to content

Password leak when Windows Logging is enabled #602

@iRon7

Description

@iRon7

Describe the issue
From some basic testing and reverse engineering it appears that psPas leaks password to the eventlog when Windows logging (without Protected Event Logging) is enabled.

See also: https://stackoverflow.com/q/79877875/1701026

To Reproduce
Steps to reproduce the behavior:

  1. Enable Windows Logging
  2. Run a command as: New-PASSession -Credential $SACredential -BaseUri $BaseUri
  3. Search the eventlog for e.g. Invoke-PASRestMethod (or your password)

Expected behavior
Passwords to be kept secret

Screenshots & Console Output
Eventlog snippet:

ParameterBinding(Invoke-PASRestMethod): name="Body"; value="{
    "password":  "Plain-Text Password",
    "username":  "Username"
}"

Your Environment

  • PowerShell Version:
Name                           Value
----                           -----
PSVersion                      5.1.14393.8781
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.8781
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
  • psPAS Version: 5.2.59 (not sure if the issue also exists in the latest version)
  • CyberArk Version: 14.6.1 (14.6.1.77)

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions