CVE-2024-0980: Okta Verify for Windows RCE Vulnerability

CVE-2024-0980 Overview

CVE-2024-0980 is a high-severity vulnerability affecting the Auto-update service for Okta Verify for Windows. This vulnerability consists of two separate flaws which, when combined, could allow an attacker to execute arbitrary code on affected systems. The vulnerability is classified under CWE-22 (Path Traversal), indicating that improper handling of file paths plays a central role in the exploitation chain.

Critical Impact

Successful exploitation of these combined flaws could allow an attacker with adjacent network access and low privileges to achieve arbitrary code execution, potentially compromising the confidentiality, integrity, and availability of affected Windows systems running Okta Verify.

Affected Products

• Okta Verify for Windows (versions prior to patched release)
• Windows systems with Okta Verify Auto-update service enabled

Discovery Timeline

• 2024-03-28 - CVE-2024-0980 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0980

Vulnerability Analysis

This vulnerability in Okta Verify for Windows stems from two distinct flaws within the Auto-update service that can be chained together to achieve arbitrary code execution. The vulnerability requires an attacker to have adjacent network access and low-level privileges on the target system, making it a local privilege escalation scenario rather than a remote attack.

The path traversal weakness (CWE-22) suggests that the Auto-update service fails to properly sanitize or validate file paths during the update process. This could allow an attacker to manipulate the update mechanism to write files to arbitrary locations on the filesystem or load malicious code during the update routine.

Root Cause

The root cause is improper input validation in the Okta Verify Auto-update service for Windows. The service appears to trust certain inputs related to file paths without adequate sanitization, allowing path traversal sequences to bypass intended directory restrictions. When combined with a secondary flaw in the update process, this enables an attacker to execute arbitrary code with the privileges of the update service.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be on the same local network segment as the target system. With low-level privileges already established on the system, an attacker can exploit the path traversal vulnerability in the Auto-update service to manipulate file paths. By combining this with the secondary flaw in the update mechanism, the attacker can achieve code execution.

The attack does not require user interaction, making it particularly dangerous in enterprise environments where Okta Verify is commonly deployed for multi-factor authentication purposes. For detailed technical information, refer to the Okta Security Advisory CVE-2024-0980.

Detection Methods for CVE-2024-0980

Indicators of Compromise

• Unusual file write operations by the Okta Verify Auto-update service to directories outside its normal scope
• Suspicious process spawning from Okta Verify update components
• Path traversal patterns in file system access logs related to Okta Verify processes
• Unexpected network connections from Okta Verify service processes

Detection Strategies

• Monitor the Okta Verify Auto-update service for anomalous file operations using endpoint detection tools
• Implement file integrity monitoring on critical system directories that should not be modified by the update service
• Configure Windows Event Log auditing to capture process creation events from Okta Verify components
• Use behavioral analysis to detect update services writing files to unexpected locations

Monitoring Recommendations

• Enable detailed logging for the Okta Verify application and its associated services
• Configure SIEM rules to alert on path traversal patterns (e.g., .. sequences) in file access logs
• Monitor for privilege escalation attempts following Okta Verify Auto-update service activity
• Establish baseline behavior for the Auto-update service to identify deviations

How to Mitigate CVE-2024-0980

Immediate Actions Required

• Update Okta Verify for Windows to the latest patched version immediately
• Review systems for any signs of compromise using the indicators listed above
• Temporarily disable the Auto-update service if immediate patching is not possible
• Restrict network access to minimize adjacent network attack surface

Patch Information

Okta has released a security patch addressing this vulnerability. Organizations should update Okta Verify for Windows to the latest available version as soon as possible. Detailed patch information and download links are available in the Okta Security Advisory CVE-2024-0980.

Workarounds

• Disable the Okta Verify Auto-update service temporarily and perform manual updates until the patch is applied
• Implement network segmentation to limit adjacent network access opportunities
• Apply application whitelisting to prevent unauthorized code execution
• Use endpoint protection solutions to monitor and block suspicious behavior from the update service

# Temporarily disable Okta Verify Auto-update service (Windows PowerShell)
Stop-Service -Name "OktaVerifyAutoUpdate" -Force
Set-Service -Name "OktaVerifyAutoUpdate" -StartupType Disabled