CVE-2024-20292: Cisco Duo Authentication Info Disclosure

CVE-2024-20292 Overview

A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of an unencrypted registry key in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view sensitive information in clear text.

Critical Impact

Authenticated local attackers can access sensitive authentication-related information stored in clear text within log files, potentially compromising security credentials and enabling further attacks.

Affected Products

• Cisco Duo Authentication for Windows Logon and RDP (all vulnerable versions)

Discovery Timeline

• 2024-03-06 - CVE-2024-20292 published to NVD
• 2025-03-24 - Last updated in NVD database

Technical Details for CVE-2024-20292

Vulnerability Analysis

This information disclosure vulnerability (CWE-200, CWE-312) affects the logging component of Cisco Duo Authentication for Windows Logon and RDP. The flaw enables authenticated local users to extract sensitive authentication data from system logs. The vulnerability requires local access and low-privilege authentication to exploit, with no user interaction necessary. While the scope is limited to confidentiality impact (high), there is no impact to integrity or availability of the system.

Root Cause

The root cause of CVE-2024-20292 is improper storage of an unencrypted registry key in certain log files. The logging component fails to adequately sanitize or encrypt sensitive data before writing it to logs, violating secure coding practices for handling authentication-related information. This cleartext storage of sensitive data (CWE-312) combined with information exposure (CWE-200) creates a pathway for local attackers to harvest credentials or sensitive configuration data.

Attack Vector

The attack vector is local, meaning an attacker must have authenticated access to the affected Windows system. The exploitation process involves:

1. The attacker gains local access to a Windows system running Cisco Duo Authentication for Windows Logon and RDP
2. The attacker navigates to or accesses the log files generated by the Duo Authentication component
3. The attacker reads the logs to extract sensitive information stored in clear text, including unencrypted registry key data
4. The harvested information could potentially be used for further attacks, credential abuse, or lateral movement

The vulnerability does not require elevated privileges beyond basic local user authentication, making it accessible to any authenticated user on the affected system.

Detection Methods for CVE-2024-20292

Indicators of Compromise

• Unexpected or repeated access to Cisco Duo Authentication log files by non-administrative users
• Abnormal file read operations targeting Duo log directories
• Evidence of log file exfiltration or copying to unusual locations

Detection Strategies

• Monitor file access events on Duo Authentication log directories using Windows Security Event logs (Event ID 4663)
• Deploy file integrity monitoring solutions to detect unauthorized access to sensitive log files
• Implement user behavior analytics to identify anomalous access patterns to authentication-related logs

Monitoring Recommendations

• Enable detailed auditing for file system access on directories containing Duo Authentication logs
• Configure SIEM rules to alert on bulk log file access or read operations by standard users
• Review access control lists on log directories to ensure least-privilege principles are enforced

How to Mitigate CVE-2024-20292

Immediate Actions Required

• Review and apply the latest security patches from Cisco for Duo Authentication for Windows Logon and RDP
• Restrict file system permissions on Duo Authentication log directories to administrative users only
• Audit user access to affected systems and review logs for signs of prior exploitation

Patch Information

Cisco has released a security advisory addressing this vulnerability. Organizations should consult the Cisco Security Advisory for detailed patch information and upgrade instructions. Ensure that Cisco Duo Authentication for Windows Logon and RDP is updated to a version that addresses CVE-2024-20292.

Workarounds

• Implement strict access controls on log file directories to limit access to only authorized administrators
• Enable Windows file system auditing to track and alert on log file access attempts
• Consider relocating log files to more restricted locations with enhanced monitoring until patches can be applied
• Review and purge existing log files that may contain sensitive cleartext data after backing up for forensic purposes if needed

# Restrict log directory permissions (example)
icacls "C:\ProgramData\Duo Security\logs" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F"