Patch this critical Safeguard for Privileged Passwords auth bypass flaw (CVE-2024-45488)
Researchers have released technical details about CVE-2024-45488, a critical authentication bypass vulnerability affecting One Identity’s Safeguard for Privileged Passwords (SPP), which could allow attackers to gain full administrative access to the virtual appliance.
“Once an attacker has gained an authenticated administrative session on the appliance, they can carry out any action that a legitimate administrator user would be capable of. This includes the ability to reconfigure settings on the appliance, or modify policies to allow extraction of passwords stored in managed accounts or personal vaults,” AmberWolf researchers have explained.
“If the appliance is configured to use the default backup encryption setting (which uses a hardcoded RSA key), then the attacker can also download and decrypt a copy of any appliance backups.”
About CVE-2024-45488
One Identity Safeguard for Privileged Passwords is a solution that “automates, controls and secures the process of granting privileged credentials with role-based access management and automated work flows.”
CVE-2024-45488 (aka “Skeleton Cookie”) arises from the presence of a hard-coded cryptographic key in SPP virtual appliance images, which could be used by attackers to forge session cookies.
The easy-to-understand write-up by researchers David Cash and Richard Warren details the discovery of the vulnerability and includes a video demo of their exploit in action.
Is your virtual appliance vulnerable?
After the researchers shared their findings, One Identity confirmed that the vulnerability does not impact deployments running on physical appliances, hosted in Azure, AWS, OCI or other officially supported cloud platforms – just Safeguard for Privileged Passwords hosted on VMware or HyperV.
Users have been advised to upgrade to Safeguard for Privileged Passwords 7.0.5.1 LTS, 7.4.2 or 7.5.2, which contain the fix.
AmberWolf researchers have also released a script users can check whether their instance is vulnerable to CVE-2024-45488 exploitation.
source: HelpNetSecurity
Free security scan for your website
Top News:
Attackers are exploiting 2 zero-days in Palo Alto Networks firewalls (CVE-2024-0012, CVE-2024-9474)
November 18, 2024CWE top 25 most dangerous software weaknesses
November 21, 2024Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor
November 21, 2024APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware
November 23, 2024Microsoft rolls out Recall to Windows Insiders with Copilot+ PCs
November 23, 2024Download: CIS Critical Security Controls v8.1
August 8, 2024