CVE-2024-1764
📋 TL;DR
This vulnerability allows users in Devolutions Server to retain elevated privileges beyond their intended expiration time. Attackers could exploit this to maintain unauthorized access to sensitive systems. Organizations running affected versions of Devolutions Server are at risk.
💻 Affected Systems
- Devolutions Server
📦 What is this software?
Devolutions Server by Devolutions
⚠️ Risk & Real-World Impact
Worst Case
An attacker could maintain persistent administrative access to the Devolutions Server environment, potentially compromising all managed systems and credentials.
Likely Case
Authorized users accidentally or intentionally retain elevated privileges longer than intended, leading to privilege creep and potential policy violations.
If Mitigated
With proper monitoring and least privilege principles, impact is limited to temporary privilege retention that can be detected and revoked.
🎯 Exploit Status
Requires authenticated user access to the Devolutions Server interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2023.3.15.0 or later
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2024-0002
Restart Required: Yes
Instructions:
1. Download latest version from Devolutions website. 2. Backup current installation. 3. Run installer with administrative privileges. 4. Restart Devolutions Server service.
🔧 Temporary Workarounds
Disable JIT Elevation
allTemporarily disable Just-in-Time elevation functionality to prevent exploitation
Navigate to Administration > Security > JIT Elevation Settings and disable the feature
Manual Privilege Review
allRegularly audit and manually revoke elevated privileges
Review user sessions and manually revoke elevated privileges through administration interface
🧯 If You Can't Patch
- Implement strict session monitoring and alert on extended privilege usage
- Enforce regular privilege reviews and manual revocation procedures
🔍 How to Verify
Check if Vulnerable:
Check Devolutions Server version in Administration > About. If version is 2023.3.14.0 or earlier, system is vulnerable.Check Version:
Check version in web interface at Administration > About or via PowerShell: Get-Service DevolutionsServer | Select-Object -Property Name, DisplayName, StatusVerify Fix Applied:
Verify version is 2023.3.15.0 or later in Administration > About, then test JIT elevation expiration functionality.📡 Detection & Monitoring
Log Indicators:
- Extended privilege sessions beyond configured expiration times
- Multiple privilege elevation requests from same user
Network Indicators:
- Unusual authentication patterns to privileged resources
SIEM Query:
source="devolutions_server" AND (event_type="privilege_elevation" AND duration>expiration_time)