BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-12356 | Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an unauthenticated command injection flaw (CWE-77) that allows a remote attacker to inject commands that are executed as a site user. The vulnerability is network-facing with low attack complexity and requires no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), so any attacker who can reach the affected PRA/RS interface can trigger it. Successful exploitation yields arbitrary command execution in the context of the site user, with high impact ratings for confidentiality, integrity, and availability. Any organization running BeyondTrust PRA or RS — particularly where those remote-access/remote-support services are exposed to the internet — is affected; the available data does not specify affected version ranges. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-19, carries an 88% EPSS probability of exploitation within 30 days (100th percentile), and was reportedly used in the breach of the U.S. Treasury alongside a PostgreSQL vulnerability. Do: Apply BeyondTrust's patches or vendor-specified mitigations immediately — remediation is mandatory for U.S. federal agencies under the KEV listing, and the source data does not include fixed build numbers, so confirm the correct upgrade version in BeyondTrust's security bulletin. As an interim measure, restrict or remove internet exposure of PRA/RS endpoints and hunt for signs of exploitation (unexpected commands executed as the site user), noting this flaw was used in the U.S. Treasury intrusion. If mitigations are unavailable, CISA's required action is to discontinue use of the product. | 9.8 | 88% | KEV PoC |
| moderate≈ a few thousand internet-exposed PRA/RS instances (order-of-magnitude estimate from public internet scans) |
Full article390 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananDec 18, 2024SaaS Security / Incident Response
BeyondTrust has disclosed details of a critical security flaw in Privileged Remote Access (PRA) and Remote Support (RS) products that could potentially lead to the execution of arbitrary commands.
Privileged Remote Access controls, manages, and audits privileged accounts and credentials, offering zero trust access to on-premises and cloud resources by internal, external, and third-party users. Remote Support allows service desk personnel to securely connect to remote systems and mobile devices.
The vulnerability, tracked as CVE-2024-12356 (CVSS score: 9.8), has been described as an instance of command injection.
"A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user," the company said in an advisory.
An attacker could exploit the flaw by sending a malicious client request, effectively leading to the execution of arbitrary operating systems within the context of the site user.
The issue impacts the following versions -
- Privileged Remote Access (versions 24.3.1 and earlier) - Fixed in PRA patch BT24-10-ONPREM1 or BT24-10-ONPREM2
- Remote Support (versions 24.3.1 and earlier) - Fixed in RS patch BT24-10-ONPREM1 or BT24-10-ONPREM2
A patch for the vulnerability has already been applied to cloud instances as of December 16, 2024. Users of on-premise versions of the software are recommended to apply the latest fixes if they are not subscribed to automatic updates.
"If customers are on a version older than 22.1, they will need to upgrade in order to apply this patch," BeyondTrust said.
The company said the shortcoming was uncovered during an ongoing forensics investigation that was initiated following a "security incident" on December 2, 2024, involving a "limited number of Remote Support SaaS customers."
"A root cause analysis into a Remote Support SaaS issue identified an API key for Remote Support SaaS had been compromised," BeyondTrust said, adding it "immediately revoked the API key, notified known impacted customers, and suspended those instances the same day while providing alternative Remote Support SaaS instances for those customers."
BeyondTrust also said it's still working to determine the cause and impact of the compromise in partnership with an unnamed "cybersecurity and forensics firm."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/12/beyondtrust-issues-urgent-patch-for.html