1

I know security is pretty important for the web application, but what about windows applications running in a corporate environment, network, not accessible from outside.

Do we need to treat security issues as "high" there, or because that is running in a safe environment, it does not matter much?

Let's say a Windows Forms (.net) application running on a user's machine in the corporate network and it has something like this issue

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

If that is a web application, I understand the risk is super high. But in the case of the windows app, should it be fixed or just ignored, especially if we consider the cost associated with fixing it?

1 Answer 1

4

Yes, it is important to fix vulnerabilities inside a corporate environment, even if these hosts are not internet-facing.

Why? Because if the endpoint is used by an employee, it can be compromised via phishing, malware, breached VPN access or similar means. This means your idea of a "safe environment" doesn't hold up to reality. If your security is based on the fact that you don't expect an attacker to be able to access the application, then one compromised host can lead to compromise of many or all hosts running the vulnerable application.

This leads to the next point, which is Lateral Movement. Lateral Movement is the process of an attacker compromising other hosts with similar privileges, in order to maintain their access and get access to more information.

For example, having access to every employee endpoint could enable an attacker to perform more sophisticated attacks, such as stealing tokens from the local system administrator, or finding credentials inside a maintainance script for the Domain Controller.

As a final step, an attacker can then use the gathered information to attack high-value targets, such as Domain Controllers, Database Servers, etc...


To Summarize: While the vulnerable native application was not the first step in this hypothetical attacker's path, it was instrumental to giving the attacker access to a wide variety of hosts, which in turn contained a high amount of usable information.

As a result, it is highly advisable to remediate vulnerabilities in native applications, even if they are only run inside a corprorate environment.

2
  • 1
    Hi and welcome to StackExchange. That was a great answer. However, I made a major revision to your answer, mostly in terms of formatting and grammar. If you like your original version better, feel free to roll back to that one.
    – user163495
    Nov 4, 2021 at 3:11
  • Ok, let's say the user's machine is compromised. But in this case, the attacker already has full access to everything on the device; he does not need to use our application. He can execute whatever commands he wants. Am I missing something? I just can't figure out how our application can help the attacker do something he can't do already if the machine is compromised.
    – Yaplex
    Nov 4, 2021 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .