CVE-2024-10094: Pega Infinity RCE Vulnerability

CVE-2024-10094 Overview

CVE-2024-10094 is a code injection vulnerability affecting Pega Platform versions 6.x through Infinity 24.1.1. This vulnerability involves Improper Control of Generation of Code (CWE-94), which allows attackers to inject and execute arbitrary code within the Pega Infinity platform. The network-accessible nature of this vulnerability combined with no authentication requirements makes it particularly dangerous for exposed Pega deployments.

Critical Impact

This code injection vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected Pega Infinity installations, potentially leading to complete system compromise, data exfiltration, and lateral movement within enterprise environments.

Affected Products

• Pega Infinity versions 6.x through 8.x
• Pega Infinity versions 23.x
• Pega Infinity version 24.1.1 and earlier

Discovery Timeline

• November 20, 2024 - CVE-2024-10094 published to NVD
• March 10, 2025 - Last updated in NVD database

Technical Details for CVE-2024-10094

Vulnerability Analysis

This vulnerability stems from improper control of code generation within the Pega Infinity platform. The platform fails to adequately sanitize or validate user-supplied input before incorporating it into dynamically generated code. This architectural flaw enables attackers to craft malicious input that, when processed by the platform, results in the execution of attacker-controlled code.

The vulnerability is network-accessible and requires no authentication or user interaction to exploit. When successfully leveraged, an attacker can achieve complete compromise of the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2024-10094 is classified as CWE-94 (Improper Control of Generation of Code), commonly known as "Code Injection." This weakness occurs when software constructs code segments using externally-influenced input without proper neutralization of special elements that could modify the intended code syntax or behavior. In the context of Pega Infinity, the platform dynamically generates code based on user input without implementing sufficient validation controls, allowing malicious code injection.

Attack Vector

The attack vector for this vulnerability is network-based, meaning attackers can exploit it remotely without requiring local access to the target system. The exploitation path involves:

1. An attacker identifies an exposed Pega Infinity instance
2. Crafted malicious input is submitted through a vulnerable endpoint
3. The platform processes the input and incorporates it into dynamically generated code
4. The injected code executes with the privileges of the Pega application
5. The attacker gains unauthorized access to execute arbitrary operations

The attack requires no privileges and no user interaction, making it highly exploitable against internet-facing Pega deployments. Refer to the Pega Security Advisory D24 for specific technical details about vulnerable endpoints and exploitation vectors.

Detection Methods for CVE-2024-10094

Indicators of Compromise

• Unusual process spawning or child processes from Pega application server processes
• Unexpected outbound network connections from Pega infrastructure
• Anomalous log entries indicating code execution attempts or injection patterns
• Modifications to Pega configuration files or application components

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block code injection patterns targeting Pega endpoints
• Monitor application logs for suspicious input patterns containing code constructs or escape sequences
• Deploy endpoint detection and response (EDR) solutions to identify anomalous behavior on Pega servers
• Utilize network intrusion detection systems (NIDS) to monitor traffic to Pega instances for exploitation attempts

Monitoring Recommendations

• Enable verbose logging on Pega Infinity instances and centralize log collection for analysis
• Configure alerting for authentication failures, privilege escalation attempts, and unusual API calls
• Implement file integrity monitoring on critical Pega platform directories
• Establish baseline behavioral profiles for Pega servers to detect deviations indicative of compromise

How to Mitigate CVE-2024-10094

Immediate Actions Required

• Inventory all Pega Infinity installations and identify instances running vulnerable versions (6.x through 24.1.1)
• Apply the security patches provided by Pega as outlined in Security Advisory D24
• Restrict network access to Pega instances using firewall rules and network segmentation
• Review and audit existing Pega configurations for any signs of compromise

Patch Information

Pega has released security patches to address this vulnerability. Organizations should consult the Pega Security Advisory D24 for detailed remediation instructions and patch download information. The advisory provides specific guidance on upgrading affected Pega Infinity installations to secure versions.

Workarounds

• Implement strict network access controls to limit exposure of Pega Infinity instances to trusted networks only
• Deploy a web application firewall (WAF) with rules specifically designed to detect code injection attempts
• Enable enhanced input validation on application entry points where feasible through Pega configuration
• Consider temporarily disabling vulnerable features or endpoints until patches can be applied

# Example: Restrict network access to Pega Infinity using iptables
# Allow access only from trusted internal networks
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP