CVE-2024-37130
📋 TL;DR
Dell OpenManage Server Administrator (OMSA) versions 11.0.1.0 and prior contain a local privilege escalation vulnerability via XSL hijacking. A local low-privileged user can exploit this to gain admin privileges and full system control. This affects systems running vulnerable OMSA versions.
💻 Affected Systems
- Dell OpenManage Server Administrator (OMSA)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, allowing data theft, persistence installation, and lateral movement.
Likely Case
Local attacker gains administrative privileges on the affected server, potentially compromising sensitive data and system integrity.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though privilege escalation remains possible.
🎯 Exploit Status
Exploitation requires local access with low privileges. XSL hijacking techniques are well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.2.0 or later
Restart Required: Yes
Instructions:
1. Download OMSA version 11.0.2.0 or later from Dell support site. 2. Backup current configuration. 3. Install the update following Dell's documentation. 4. Restart the system.
🔧 Temporary Workarounds
Restrict local user access
allLimit local user accounts to only trusted personnel and implement least privilege principles.
Monitor for suspicious activity
allImplement monitoring for privilege escalation attempts and unusual administrative actions.
🧯 If You Can't Patch
- Remove OMSA from non-essential systems if not required
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check OMSA version: On Windows use 'Add/Remove Programs', on Linux run 'rpm -qa | grep srvadmin' or 'dpkg -l | grep srvadmin'Check Version:
Windows: Check Programs and Features. Linux: 'rpm -qa | grep srvadmin' (RHEL) or 'dpkg -l | grep srvadmin' (Debian/Ubuntu)Verify Fix Applied:
Verify OMSA version is 11.0.2.0 or later using the same commands📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events
- Suspicious process creation by low-privileged users
- OMSA-related service anomalies
Network Indicators:
- Local system calls indicating privilege changes
SIEM Query:
EventID=4688 AND ProcessName LIKE '%OMSA%' AND NewProcessName LIKE '%admin%' OR EventID=4672🔗 References
- https://www.dell.com/support/kbdoc/en-us/000225914/dsa-2024-264-dell-openmanage-server-administrator-omsa-security-update-for-local-privilege-escalation-via-xsl-hijacking-vulnerability
- https://www.dell.com/support/kbdoc/en-us/000225914/dsa-2024-264-dell-openmanage-server-administrator-omsa-security-update-for-local-privilege-escalation-via-xsl-hijacking-vulnerability
