NeuVector Process Rule Violation Leads to Sensitive Data Leakage

A vulnerability in NeuVector versions 5.0.0 prior to 5.4.6 allows for the leakage of sensitive information, such as passwords, into the NeuVector security event log. This occurs when a Java command containing password parameters is executed and subsequently terminated due to a NeuVector Process rule violation. NeuVector's default behavior is to redact certain sensitive data from process commands in security events, but this vulnerability arises when the default redaction patterns do not cover the specific format of the sensitive information being logged.

Impact

Exploitation of this vulnerability results in the unintended exposure of sensitive data, such as passwords, in the NeuVector security event log.

Reproduction

To reproduce this vulnerability, execute a Java command that includes password parameters, such as a trust store password, and then terminate the command. The password will be logged in the NeuVector security event log, demonstrating the leakage of sensitive information.

Remediation

Upgrade to NeuVector version 5.4.6 or later, where this issue has been fixed.