CVE-2024-12908: Delinea Secret Server RCE Vulnerability

CVE-2024-12908 Overview

CVE-2024-12908 affects Delinea Secret Server v11.7.31 and its associated protocol handler version 6.0.3.26. The protocol handler compares Uniform Resource Identifiers (URIs) before normalization and canonicalization. This sequence enables over-matching against the approved list, allowing crafted URIs to pass validation checks. A remote attacker who convinces a user to visit a malicious web page or open a malicious document can trigger the vulnerable handler and execute arbitrary code on the user's machine. The flaw is tracked under [CWE-94] Improper Control of Generation of Code. Delinea has released a fix that adds validation that the downloaded installer's batch file matches the expected format.

Critical Impact
Successful exploitation grants arbitrary code execution on the workstation running the Secret Server protocol handler, providing a pivot point into privileged credential workflows.

Affected Products

Delinea Secret Server (on-premises) v11.7.31 and earlier
Delinea Secret Server Protocol Handler version 6.0.3.26 and earlier
Endpoints with the Delinea protocol handler registered for URI scheme invocation

Discovery Timeline

2024-12-26 - CVE-2024-12908 published to the National Vulnerability Database (NVD)
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-12908

Vulnerability Analysis

The Delinea Secret Server protocol handler registers a custom URI scheme on Windows endpoints. When a user activates a URI bound to the handler, the application parses the URI and validates it against an allow list of trusted endpoints before initiating an update or installer download. The vulnerable code path performs string comparison against the raw URI before applying normalization or canonicalization routines. Encoded characters, traversal segments, or alternate representations that resolve to a different host after canonicalization can pass the pre-normalization comparison. The handler then proceeds to fetch and execute installer content from an attacker-controlled location.

Root Cause

The root cause is a Time-of-Check to Time-of-Use mismatch on URI strings. The handler validates the URI in its raw form, then resolves it after the check completes. Because canonicalization changes the effective host or path, the value that passes validation differs from the value used to retrieve the installer payload. The update process did not verify that the resulting batch file conformed to the expected format, removing a final safety net.

Attack Vector

Exploitation requires user interaction. An attacker hosts a page or document that invokes the Delinea custom URI scheme with a malformed but allow-list-passing target. The protocol handler downloads a batch file installer from the attacker-controlled origin and executes it within the user's session. The Amberwolf research describes the full exploitation chain through the update process. See the Amberwolf Blog Analysis for technical details on the bypass primitives and payload delivery mechanics.

Detection Methods for CVE-2024-12908

Indicators of Compromise

Unexpected execution of .bat or installer files spawned by the Delinea protocol handler process tree
Outbound HTTP or HTTPS requests from the protocol handler to hosts outside the organization's Secret Server infrastructure
Protocol handler invocations originating from browser or Office application parent processes immediately following user navigation
Newly created child processes such as cmd.exe or powershell.exe parented by the Delinea handler binary

Detection Strategies

Monitor process creation events where the Delinea protocol handler launches script interpreters or installer utilities
Inspect command-line arguments passed to the handler for encoded characters, double-encoded sequences, or unusual host components
Correlate browser URI scheme launches with subsequent file downloads and execution events on the endpoint
Alert on protocol handler downloads originating from domains not on the organization's approved Secret Server host list

Monitoring Recommendations

Enable command-line auditing through Windows Event ID 4688 and Sysmon Event ID 1 on hosts with the protocol handler installed
Forward protocol handler telemetry to a centralized analytics platform and baseline normal update behavior
Track the installed version of the Delinea Secret Server protocol handler across the fleet to identify unpatched endpoints

How to Mitigate CVE-2024-12908

Immediate Actions Required

Upgrade Delinea Secret Server and the protocol handler to the fixed releases documented in the Delinea Release Notes
Inventory endpoints with the Delinea protocol handler registered and prioritize patching for privileged users and administrators
Restrict outbound network access from endpoints to only the organization's Secret Server hostnames
Review the Delinea Trust Documentation for vendor guidance on verifying handler integrity

Patch Information

Delinea released an update that adds additional validation confirming the downloaded installer's batch file matches the expected format. The fix is documented in the Secret Server 11.7 release notes referenced above. Apply both the server-side update and the updated protocol handler on every workstation that interacts with Secret Server.

Workarounds

Unregister the Delinea custom URI scheme on endpoints where the protocol handler is not required
Apply application allow-listing policies that prevent the protocol handler from spawning cmd.exe, powershell.exe, or installer executables
Use browser policies to prompt users before launching external protocol handlers and train users to refuse unexpected prompts

bash

# Verify installed protocol handler version on Windows endpoints
reg query "HKCR\dss\shell\open\command" /s
(Get-Item "C:\Program Files\Thycotic Software Ltd\Secret Server Protocol Handler\protocolhandler.exe").VersionInfo.FileVersion