.. / CVE-2024-37393

Exploit for SecurEnvoy Two Factor Authentication < 9.4.514 - Unauthenticated Information Disclosure (CVE-2024-37393)

Description:

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.

Affected Products:

SecurEnvoy Two Factor Authentication < 9.4.514

Proof of Concept

PoC exploit

Nuclei Template

View the template here CVE-2024-37393.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2024/CVE-2024-37393.yaml

References:

https://nvd.nist.gov/vuln/detail/CVE-2024-37393
https://www.tenable.com/cve/CVE-2024-37393
https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
https://securenvoy.com

.. / CVE-2024-37393 if(localStorage["style"]=="true"){ document.getElementById('pagestyle').setAttribute('href','/assets/styleDark.css'); document.querySelector('input[type="checkbox"]').checked = true }