High · published December 16, 2025
⚡ An unprivileged attacker can impersonate any user on the machine! When Dynatrace OneAgent encounters a network access error, it starts a relentless impersonation spree that could spell disaster. 🔥 Imagine a hotel receptionist who, upon encountering a guest with the wrong ID, decides to try everyone else's identification until they find one that works. This is how the OneAgent handles network share access errors, attempting to impersonate every user it knows! An attacker could leverage this behavior to perform NTLM relay attacks, allowing them to impersonate users and gain unauthorized access to sensitive resources. If successful, the attacker might feast on data they shouldn't see, leading to devastating breaches of trust and security.
Imagine a hotel receptionist who, upon encountering a guest with the wrong ID, decides to try everyone else's identification until they find one that works. This is how the OneAgent handles network share access errors, attempting to impersonate every user it knows! This vulnerability allows Dynatrace OneAgent to retrieve all user tokens on a machine when access to a remote network share fails, enabling an unprivileged attacker to exploit these tokens via NTLM relays.
An attacker could leverage this behavior to perform NTLM relay attacks, allowing them to impersonate users and gain unauthorized access to sensitive resources. If successful, the attacker might feast on data they shouldn't see, leading to devastating breaches of trust and security. To mitigate this vulnerability, update Dynatrace OneAgent to version 1.325.47 or later immediately. Additionally, ensure that strict access controls are in place for network shares and monitor your systems for any suspicious activity. You've got this! With these steps, you'll untangle this vulnerability in no time and keep your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dynatrace/oneagent | < 1.325.47 | 1.325.47 |