EUVD lists unauthenticated RCE as LocalSystem in Delinea Privilege Manager
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Delinea
- Product
- Privilege Manager
- First seen
Summary
The EUVD entry, as relayed in a Mastodon post, describes a flaw that under certain conditions lets a remote unauthenticated attacker run arbitrary code as LocalSystem through the privilege manager agent. The item gives a CVSS v3.1 score of 8.7/10.
If you use Delinea
Check the Delinea advisory to see whether your deployment meets the vulnerable conditions
Apply the vendor's fixed agent version
Limit network exposure of the privilege manager agent until it is patched
Upgrade Secret Server to 12.3.1 or later
Review recent authentication logs for logins that skipped the primary step
Rotate credentials for privileged accounts if suspicious logins are found
What the sources say 4
· Mastodon: “Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.” Source
· Mastodon: “In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device” Source
· Mastodon: “In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.” Source
· Mastodon: “In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.” Source