CVE-2024-20430: Cisco Meraki SM Privilege Escalation

CVE-2024-20430 Overview

A vulnerability in Cisco Meraki Systems Manager (SM) Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is classified as a DLL Hijacking vulnerability (CWE-427) and stems from incorrect handling of directory search paths at runtime.

A low-privileged attacker could exploit this vulnerability by placing both malicious configuration files and malicious DLL files on an affected system, which would read and execute the files when Cisco Meraki SM launches on startup. A successful exploit could allow the attacker to execute arbitrary code on the affected system with SYSTEM privileges.

Critical Impact

Local privilege escalation to SYSTEM level access through DLL hijacking during Cisco Meraki SM Agent startup, enabling complete system compromise.

Affected Products

• Cisco Meraki Systems Manager Agent for Windows

Discovery Timeline

• 2024-09-12 - CVE CVE-2024-20430 published to NVD
• 2024-09-18 - Last updated in NVD database

Technical Details for CVE-2024-20430

Vulnerability Analysis

This vulnerability exploits a common weakness in Windows applications where the DLL search order is not properly restricted. When Cisco Meraki Systems Manager Agent starts on Windows, it attempts to load certain DLL files without specifying the complete path. The application searches for these libraries in multiple directories following the Windows DLL search order, which can include user-writable locations.

The attack requires local access and authentication, but only low privileges are needed. User interaction is required as the exploit triggers during application startup. When successful, the attacker gains code execution with SYSTEM privileges, representing a significant elevation from their initial low-privileged state.

Root Cause

The root cause is CWE-427: Uncontrolled Search Path Element. The Cisco Meraki SM Agent for Windows does not properly control or restrict the directory search paths used when loading dynamic-link libraries at runtime. This allows an attacker to place malicious DLLs in locations that are searched before the legitimate DLL locations, resulting in the malicious code being loaded instead.

Attack Vector

The attack vector is local and requires the following conditions:

1. The attacker must have local access to the target Windows system
2. The attacker must have low-privilege authentication on the system
3. The attacker places malicious configuration files and DLL files in directories searched by the Cisco Meraki SM Agent
4. The attack is triggered when the Cisco Meraki SM Agent launches on system startup
5. The malicious DLL is loaded and executed with SYSTEM privileges

The attacker leverages the Windows DLL search order mechanism, placing a malicious DLL with a specific filename that the Meraki SM Agent attempts to load. When the service starts with elevated privileges, it inadvertently executes the attacker's malicious code with those same elevated privileges.

Detection Methods for CVE-2024-20430

Indicators of Compromise

• Unexpected DLL files in directories accessible to low-privileged users that are in the DLL search path
• Unusual configuration files appearing in Cisco Meraki SM Agent directories
• Suspicious process execution with SYSTEM privileges originating from the Meraki SM Agent process
• Anomalous file writes to system directories during or before Meraki SM Agent startup

Detection Strategies

• Monitor for DLL files being created or modified in user-writable directories that are in the search path of the Meraki SM Agent
• Implement file integrity monitoring on critical directories associated with Cisco Meraki SM installations
• Use endpoint detection to identify unsigned or suspicious DLLs being loaded by trusted processes
• Configure Windows AppLocker or similar application control policies to restrict DLL loading locations

Monitoring Recommendations

• Enable detailed Windows Security Event logging for DLL loading events (Event ID 7 in Sysmon)
• Monitor startup processes for anomalous child process spawning with elevated privileges
• Implement SentinelOne's behavioral AI detection to identify privilege escalation attempts during service startup
• Review process execution logs for unexpected SYSTEM-level processes spawned by Meraki SM Agent

How to Mitigate CVE-2024-20430

Immediate Actions Required

• Update Cisco Meraki Systems Manager Agent for Windows to the latest patched version immediately
• Review systems for any unauthorized DLL or configuration files in user-writable directories
• Audit user permissions to restrict write access to directories in the DLL search path
• Consider temporarily disabling the Meraki SM Agent service until patching is complete on critical systems

Patch Information

Cisco has released a security update to address this vulnerability. Administrators should apply the patch as described in the Cisco Security Advisory. The update corrects the DLL search path handling to prevent loading of unauthorized libraries from user-controlled directories.

Workarounds

• Implement strict file system permissions to prevent low-privileged users from writing to directories in the Meraki SM Agent's DLL search path
• Use Windows Group Policy to configure DLL Safe Search Mode and restrict search paths
• Deploy application whitelisting solutions to prevent unauthorized DLLs from executing
• Monitor and restrict write access to the Cisco Meraki SM Agent installation directory

# PowerShell: Check for suspicious DLLs in common hijack locations
Get-ChildItem -Path "C:\ProgramData\Cisco\*" -Filter "*.dll" -Recurse | 
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, CreationTime, LastWriteTime