CVE-2024-12356
📋 TL;DR
This critical vulnerability in BeyondTrust Privileged Remote Access and Remote Support products allows unauthenticated attackers to execute arbitrary commands with site user privileges. It affects organizations using these products for remote access and support. The vulnerability enables remote code execution without authentication.
💻 Affected Systems
- BeyondTrust Privileged Remote Access
- BeyondTrust Remote Support
📦 What is this software?
Remote Support by Beyondtrust
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the BeyondTrust server leading to lateral movement across the network, data exfiltration, and persistent backdoor installation.
Likely Case
Attackers gain initial access to the network through the BeyondTrust server, then pivot to other systems to deploy ransomware or steal credentials.
If Mitigated
Limited impact if server is isolated with strict network segmentation and access controls, though command execution would still be possible on the server itself.
🎯 Exploit Status
Exploitation is trivial with publicly available proof-of-concept code. CISA has added this to their Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Privileged Remote Access: 23.4.2 and later; Remote Support: 24.1.1 and later
Vendor Advisory: https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
Restart Required: Yes
Instructions:
1. Download the latest patched version from BeyondTrust support portal. 2. Backup current configuration. 3. Install the update following vendor documentation. 4. Restart the service/application. 5. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to the BeyondTrust server to only trusted IP addresses
Use firewall rules to limit inbound connections to specific source IPs
Disable Web Interface
allTemporarily disable the vulnerable web interface component if not required
Consult BeyondTrust documentation for disabling specific web services
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the BeyondTrust server from critical systems
- Deploy web application firewall (WAF) rules to block command injection patterns
🔍 How to Verify
Check if Vulnerable:
Check the product version against affected versions listed in the BeyondTrust advisory. Versions below 23.4.2 for PRA and below 24.1.1 for RS are vulnerable.Check Version:
Check the product version in the web interface under Help > About or use vendor-specific CLI commands for version checking.Verify Fix Applied:
Verify the installed version is 23.4.2 or higher for PRA, or 24.1.1 or higher for RS. Check vendor documentation for specific patch verification steps.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns in BeyondTrust logs
- Multiple failed authentication attempts followed by successful command execution
- Suspicious process creation from BeyondTrust service accounts
Network Indicators:
- Unusual outbound connections from BeyondTrust server
- Command and control traffic originating from the BeyondTrust server
- Unexpected network scans from the BeyondTrust server
SIEM Query:
source="beyondtrust" AND (event_type="command_execution" OR process_name="cmd.exe" OR process_name="powershell.exe") | stats count by src_ip, user🔗 References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12356
- https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
- https://www.cve.org/CVERecord?id=CVE-2024-12356
- https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356
