CVE-2024-11220
📋 TL;DR
This vulnerability allows local low-privileged users on servers running OAS services to execute arbitrary code with SYSTEM privileges by creating and running reports with malicious rdlx files. This results in complete privilege escalation on affected systems. Organizations using Open Automation Software products are affected.
💻 Affected Systems
- Open Automation Software products with OAS services
📦 What is this software?
Open Automation Software by Openautomationsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains SYSTEM privileges, enabling installation of persistent malware, credential theft, lateral movement, and full control of the server.
Likely Case
Privilege escalation by legitimate low-level users or attackers who have gained initial access, leading to unauthorized administrative access and potential data exfiltration.
If Mitigated
Limited impact due to restricted local access, proper user account management, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires authenticated access to OAS services but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references; check vendor advisory for latest patched version
Vendor Advisory: https://openautomationsoftware.com/downloads/
Restart Required: Yes
Instructions:
1. Download latest version from Open Automation Software website. 2. Install update following vendor instructions. 3. Restart OAS services and affected systems.
🔧 Temporary Workarounds
Restrict Local User Access
windowsLimit which users have local access to servers running OAS services
Remove Unnecessary OAS Service Credentials
windowsReview and remove OAS service credentials from low-privileged users who don't require them
🧯 If You Can't Patch
- Implement strict principle of least privilege for all local user accounts
- Segment OAS servers from critical systems and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if OAS services are running and if low-privileged users have access credentials. Review system for unauthorized rdlx file execution.Check Version:
Check OAS software version through vendor-provided tools or control panelVerify Fix Applied:
Verify OAS software version is updated to latest release from vendor and test that low-privileged users cannot execute rdlx files with elevated privileges.📡 Detection & Monitoring
Log Indicators:
- Unusual rdlx file creation or execution events
- Privilege escalation attempts in Windows security logs
- OAS service authentication from unexpected users
Network Indicators:
- Unusual outbound connections from OAS servers post-exploitation
SIEM Query:
Windows Event ID 4688 with process creation containing 'rdlx' OR OAS service authentication logs showing privilege changes