CVE-2021-38147

What it actually does

Wipro Holmes Orchestrator 20.4.1 exposes report-download API endpoints that do not enforce authentication. A remote, unauthenticated attacker can directly request specific DownloadExcelFile routes and retrieve generated Excel reports, including domain credential, user, process, infrastructure, and resolver reports. The impact is primarily confidentiality loss: the flaw enables unauthorized disclosure of operational and potentially sensitive identity, infrastructure, and process data without requiring credentials, user interaction, or local access.

Why it matters to the business

Successful exploitation can expose sensitive operational reports, including information about users, infrastructure, processes, and potentially credential-related data. This can support follow-on attacks such as credential theft, lateral movement, targeted phishing, privilege escalation, or reconnaissance against automation and orchestration workflows. Although it is not listed in CISA KEV, the exploit maturity is weaponized and the EPSS score is high, meaning internet-exposed or broadly reachable deployments should be treated as urgent exposure risks.

How an attack unfolds

An attacker first identifies a reachable Wipro Holmes Orchestrator instance, usually by scanning for exposed web services or known application fingerprints. Because the vulnerable report-download API routes do not require authentication, the attacker sends direct HTTP requests to the DownloadExcelFile endpoints for reports such as Domain_Credential_Report_Excel, User_Report_Excel, Process_Report_Excel, Infrastructure_Report_Excel, or Resolver_Report_Excel. If the instance is vulnerable, the server returns Excel report content without challenging the attacker for credentials. The attacker can then review the downloaded reports for usernames, infrastructure details, process metadata, resolver information, and credential-related data that can be used for further intrusion planning or secondary compromise.

How to fix it

Upgrade Wipro Holmes Orchestrator to a vendor-supported version that enforces authentication and authorization on report-download APIs. No fixed version was provided in the input, so confirm the corrected release directly with Wipro support or official advisories. As immediate mitigations, restrict access to the Orchestrator web/API interface to trusted administrative networks, place it behind VPN or zero-trust access controls, block unauthenticated access to /processexecution/DownloadExcelFile/ routes at a reverse proxy or WAF where feasible, and review application access-control configuration. Treat any previously exposed reports as potentially compromised and rotate credentials if domain credential or sensitive identity reports may have been downloaded.

How to confirm the fix worked

Confirm the deployed Wipro Holmes Orchestrator version is no longer 20.4.1 or has received a vendor-confirmed security fix. From an unauthenticated network context, attempt to access the known report-download routes and verify the application returns an authentication challenge, authorization failure, or generic denial rather than an Excel file. Review reverse proxy, WAF, and application logs to ensure requests to /processexecution/DownloadExcelFile/ are blocked or require authenticated sessions. Validate that access to report generation and download functions is limited to authorized roles and that sensitive reports cannot be retrieved by direct URL access.

Typical attack path

1. Discover a reachable Wipro Holmes Orchestrator 20.4.1 web interface or API service.
2. Fingerprint the application version or test for known unauthenticated report-download routes.
3. Send unauthenticated HTTP GET or POST requests to vulnerable processexecution/DownloadExcelFile endpoints.
4. Download Excel reports returned by the application without authentication.
5. Extract sensitive user, infrastructure, process, resolver, or credential-related information from the reports.
6. Use the exposed information for reconnaissance, credential attacks, phishing, lateral movement, or targeting of automation workflows.

How to detect it

Review web server, reverse proxy, WAF, and application access logs for direct requests to vulnerable report-download API paths, especially from unauthenticated sessions, unknown external IP addresses, scanners, or clients with no prior login activity. Prioritize events where the response status was 200, the response size is consistent with an Excel file, or the content type indicates spreadsheet download. Look for repeated enumeration across multiple report names in a short period, which is a strong sign of automated exploitation. Correlate any successful downloads with subsequent authentication attempts, VPN logins, account lockouts, unusual access to infrastructure management systems, or lateral movement indicators that may indicate follow-on use of exposed data. If logs include session or user fields, investigate requests with missing, null, anonymous, or unauthenticated identities.

• /processexecution/DownloadExcelFile/Domain_Credential_Report_Excel
• /processexecution/DownloadExcelFile/User_Report_Excel
• /processexecution/DownloadExcelFile/Process_Report_Excel
• /processexecution/DownloadExcelFile/Infrastructure_Report_Excel
• /processexecution/DownloadExcelFile/Resolver_Report_Excel
• processexecution/DownloadExcelFile/Domain_Credential_Report_Excel
• processexecution/DownloadExcelFile/User_Report_Excel
• processexecution/DownloadExcelFile/Process_Report_Excel
• processexecution/DownloadExcelFile/Infrastructure_Report_Excel
• processexecution/DownloadExcelFile/Resolver_Report_Excel
• DownloadExcelFile/Domain_Credential_Report_Excel
• DownloadExcelFile/User_Report_Excel
• DownloadExcelFile/Process_Report_Excel
• DownloadExcelFile/Infrastructure_Report_Excel
• DownloadExcelFile/Resolver_Report_Excel

What your security team should do

• Identify all Wipro Holmes Orchestrator deployments and determine whether version 20.4.1 is present or whether the vulnerable DownloadExcelFile endpoints are exposed.
• Prioritize remediation for internet-facing or broadly network-accessible instances because exploitation is low-complexity, unauthenticated, and weaponized, with a high EPSS score.
• Upgrade to a vendor-supported fixed release or obtain a vendor patch; if no patch is immediately available, restrict access using VPN, network allowlists, reverse proxy rules, or WAF controls.
• Block or require authentication for requests to /processexecution/DownloadExcelFile/ endpoints at perimeter and internal web controls.
• Search historical logs for unauthenticated or suspicious access to the affected report-download endpoints, especially requests that returned HTTP 200 responses or large Excel file downloads.
• If sensitive reports may have been exposed, rotate affected credentials, review account activity, and assess whether exposed infrastructure or process data increases follow-on attack risk.