CVE-2024-27312
📋 TL;DR
CVE-2024-27312 is an authorization vulnerability in ManageEngine PAM360 version 6601 that allows low-privileged users to perform administrative actions. This affects only PAM360 6600 version installations, potentially enabling privilege escalation within the privileged access management system.
💻 Affected Systems
- ManageEngine PAM360
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with low-privileged access could gain full administrative control over the PAM360 system, potentially accessing all managed privileged credentials and systems.
Likely Case
Malicious insider or compromised low-privileged account escalates privileges to admin level, accessing sensitive credentials and performing unauthorized administrative actions.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the PAM360 system itself, though credential exposure remains a significant risk.
🎯 Exploit Status
Requires authenticated low-privileged access. Specific exploitation details not publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6602 or later
Vendor Advisory: https://www.manageengine.com/privileged-access-management/advisory/cve-2024-27312.html
Restart Required: Yes
Instructions:
1. Download PAM360 build 6602 or later from ManageEngine website. 2. Backup current installation. 3. Stop PAM360 service. 4. Apply the update. 5. Restart PAM360 service.
🔧 Temporary Workarounds
Access Restriction
allRestrict network access to PAM360 to only authorized administrative users
Privilege Review
allReview and minimize low-privileged user accounts in PAM360
🧯 If You Can't Patch
- Isolate PAM360 system from production networks using firewall rules
- Implement enhanced monitoring for privilege escalation attempts and unusual admin actions
🔍 How to Verify
Check if Vulnerable:
Check PAM360 version in web interface or installation directory. Version 6601 is vulnerable.Check Version:
Check PAM360 web interface login page or installation directory version fileVerify Fix Applied:
Verify version is 6602 or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Low-privileged users performing administrative actions
- Unusual privilege escalation patterns
- Access to admin-only functions from non-admin accounts
Network Indicators:
- Unusual API calls from low-privileged user accounts to admin endpoints
SIEM Query:
source="pam360" AND (event_type="admin_action" AND user_role="low_privilege")