CVE-2024-3319
📋 TL;DR
This vulnerability allows authenticated administrators in SailPoint Identity Security Cloud to execute arbitrary code on the host system by using user-defined templates in attribute transform previews. It affects organizations using SailPoint ISC with administrator accounts that have access to transform preview and IdentityProfile preview API endpoints.
💻 Affected Systems
- SailPoint Identity Security Cloud
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code, steal sensitive data, deploy ransomware, or establish persistent backdoors on the host system.
Likely Case
Privilege escalation leading to unauthorized access to sensitive identity data, configuration manipulation, or lateral movement within the identity management infrastructure.
If Mitigated
Limited impact if proper access controls restrict administrator privileges and network segmentation isolates the ISC environment.
🎯 Exploit Status
Exploitation requires administrator credentials but the vulnerability is in core API functionality that administrators would normally access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references; check vendor advisory for exact patched version
Vendor Advisory: https://www.sailpoint.com/security-advisories/
Restart Required: No
Instructions:
1. Access SailPoint ISC admin console. 2. Check current version against vendor advisory. 3. If vulnerable, contact SailPoint support for patching instructions. 4. Apply security updates as directed by SailPoint.
🔧 Temporary Workarounds
Restrict Administrator Access
allTemporarily limit administrator access to only essential personnel and monitor for suspicious API calls to transform preview endpoints.
No OS-level commands - implement via SailPoint ISC admin console
API Endpoint Monitoring
allImplement enhanced logging and alerting for calls to /api/v3/transform/preview and related IdentityProfile preview endpoints.
Configure via SailPoint logging settings and SIEM integration
🧯 If You Can't Patch
- Implement strict least-privilege access controls for administrator accounts
- Enable comprehensive API call logging and real-time monitoring for suspicious transform preview activities
🔍 How to Verify
Check if Vulnerable:
Check your SailPoint ISC version against the vendor security advisory and verify if you have administrator access to transform preview functionality.Check Version:
Check version in SailPoint ISC admin console under System Information or contact SailPoint supportVerify Fix Applied:
Confirm with SailPoint support that your instance has received the security update and test that user-defined templates cannot execute arbitrary code.📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to transform preview endpoints
- Administrator accounts performing unexpected template executions
- Error logs showing template execution failures
Network Indicators:
- Abnormal traffic patterns to /api/v3/transform/preview endpoints
- Unexpected outbound connections from ISC hosts
SIEM Query:
source="sailpoint_isc" AND (uri_path="/api/v3/transform/preview" OR uri_path CONTAINS "IdentityProfile/preview") AND user_role="administrator"