ServerSiteList.xml file in plain text

[Adam_Z]

I manage multiple location from my ePO, each region has own Agent handler and some of them have additional SuperAgent in order to load balancing.

I've putted my attention on ServerSiteList.xml file generated during agent installation because all information about infrastructure are stored in this particular file are in plain text. 

Isn't it a little bit sensitive if we keep FQDN which pointing to particular customer in plain text? 

Having this file attacker don't need to do any reconnaissance and can prepare target attack on AV infrustructure.

From my point of view information about infrastructure should be stored on encrypted XML or Agent DB not in plain text in location where anybody can read file.

Or maybe it's already possibile to encrypted this file but I just omimited option in ePO ?

[cdinet]

Where exactly are you seeing that sitelist file and what version of the agent are you running?  That should be in the ma.db files.

[Adam_Z]

Trellix Agent 5.7.9 installation brings ServerSiteList.xml to /opt/McAfee/agent/data directory

[cdinet]

If a hacker can get to the file on the local system, it is already compromised.  You can open an SR if you want for investigation.

[Adam_Z]

System has not been compromised yet I'm concerned about keeping information of infrastructure in plain text. That putting some risk on customer environment.
I would not willing to show everybody how AV infrastructure is configured, however keeping this information in plain text putting risk on customer in situation in case of endpoint will be stolen for exampel.

Having knowledge about customer's machines in DMZ and vulenrabilities related to McAfee/Trellix software (including apache and tomcat), the preparation of potential attack on agent handlers in DMZ would be pretty easy, that would led to disabling communication between ePO and endpoints connected to ePO over internet and that would make blind the whole security on customer side.

[cdinet · Accepted solution]

As suggested, please open a ticket as a vulnerability request.