PT-2024-21066 · Delinea · Delinea Pam Secret Server

Published 2024-03-14 · Updated 2024-03-15 · CVE-2024-25650

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Delinea PAM Secret Server version 11.4 Distributed Engine version 8.4.3

Description The issue allows a PAM administrator to obtain the Symmetric Key used to encrypt RabbitMQ messages via crafted payloads to the "/pre-authenticate", "/authenticate", and "/execute-and-respond" REST API endpoints. This enables the administrator to impersonate the Engine and exfiltrate sensitive information from the messages published in the RabbitMQ exchanges without being audited in the application.

Recommendations For Delinea PAM Secret Server version 11.4, consider disabling access to the "/pre-authenticate", "/authenticate", and "/execute-and-respond" REST API endpoints until a patch is available. For Distributed Engine version 8.4.3, restrict the use of the Symmetric Key to minimize the risk of exploitation. Avoid using crafted payloads to the vulnerable API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-25650

Affected Products

Delinea Pam Secret Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-25650 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25650 · Vendor Advisory
• https://t.me/cvenotify/73768 · Telegram Post
• https://twitter.com/RedPacketSec/status/1768579907322302805 · Twitter Post
• https://cvcn.gov.it/cvcn/cve/CVE-2024-25650 · Note
• https://twitter.com/CVEnew/status/1768213788116074832 · Twitter Post