PT-2019-10193 · Microsoft+1 · Windows Active Directory+1

B0Yd + 1 · Published 2019-01-17 · Updated 2024-08-05 · CVE-2018-20735

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: BMC PATROL Agent versions through 11.3.01

Description: An issue in the BMC PATROL Agent allows for lateral movement and escalation of privilege inside a Windows Active Directory environment. The PatrolCli application only verifies if the provided password for a given username is correct, but it does not verify the permissions of the user on the network. This enables a low-privileged domain user to authenticate with PatrolCli and then connect to a domain controller, running commands as SYSTEM. As a result, any user on a domain can potentially escalate to domain admin through the PATROL Agent.

Recommendations: For versions through 11.3.01, consider implementing a custom, non-default configuration to prevent this escalation, as suggested by the vendor, although this may not be considered adequate by all parties. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-20735

Affected Products

Bmc Patrol Agent

Windows Active Directory

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/bmc_patrol_cmd_exec.rb · Exploit
• 🔥 https://securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin · Exploit
• 🔥 https://exploit-db.com/exploits/46556 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20735 · Security Note