PT-2024-3811 · Delinea · Delinea Pam Secret Server

Published 2024-04-28 · Updated 2025-10-28 · CVE-2024-33891

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delinea Secret Server versions prior to 11.7.000001

Description The issue is related to the use of a hardcoded key for encryption in the Delinea Secret Server, allowing a remote attacker to bypass the authentication procedure. This can be achieved via the SOAP API, specifically through the endpoint "SecretServer/webservices/SSWebService.asmx". The vulnerability is also related to the use of the integer 2 for the Admin user and the removal of the oauthExpirationId attribute.

Recommendations For versions prior to 11.7.000001, update to version 11.7.000001 or later to resolve the issue. As a temporary workaround, consider restricting access to the SOAP API endpoint "SecretServer/webservices/SSWebService.asmx" until a patch is applied. Avoid using the hardcoded key for encryption until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-321

Related Identifiers

BDU:2024-04187

CVE-2024-33891

Affected Products

Delinea Pam Secret Server

References · 14

• 🔥 https://github.com/straightblast/My-PoC-Exploits/blob/master/CVE-2024-33891.py · Exploit
• 🔥 https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3 · Exploit
• https://bdu.fstec.ru/vul/2024-04187 · Security Note
• https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33891 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33891 · Vendor Advisory
• https://delinea.com/products/secret-server · Note
• https://twitter.com/straight_blast/status/1785344394201280639 · Twitter Post
• https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm · Note
• https://t.me/pentestingnews/46419 · Telegram Post
• https://t.me/cveNotify/140728 · Telegram Post
• https://vuldb.com/ru/?id.262283 · Note
• https://twitter.com/cracbot/status/1784908324204417060 · Twitter Post
• https://twitter.com/fletch_ai/status/1785550066532630710 · Twitter Post