CVE-2024-21917: FactoryTalk Auth Bypass Vulnerability

CVE-2024-21917 Overview

A critical authentication bypass vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP) that allows malicious users to obtain service tokens and use them for unauthorized authentication on other FTSP directories. This vulnerability stems from the lack of digital signing between the FTSP service token and directory, enabling attackers to potentially retrieve user information and modify settings without any authentication.

Critical Impact

This vulnerability allows unauthenticated attackers to bypass authentication mechanisms in industrial control system environments, potentially leading to unauthorized access to sensitive user data and system configuration modifications across FactoryTalk Service Platform deployments.

Affected Products

• Rockwell Automation FactoryTalk Services Platform (all versions prior to patch)
• Industrial control systems utilizing FactoryTalk® Service Platform for authentication
• Enterprise environments with multiple FTSP directory configurations

Discovery Timeline

• 2024-01-31 - CVE-2024-21917 published to NVD
• 2026-01-15 - Last updated in NVD database

Technical Details for CVE-2024-21917

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), indicating a fundamental flaw in how the FactoryTalk Service Platform validates authentication tokens. The absence of cryptographic signing between service tokens and directory services creates a critical authentication weakness that can be exploited remotely without user interaction.

The vulnerability allows attackers to intercept or obtain legitimate service tokens and replay them against different FTSP directory instances. Because no digital signature binds a token to its intended directory, the receiving system has no mechanism to verify the token's authenticity or intended scope.

Root Cause

The root cause of CVE-2024-21917 lies in the missing cryptographic signature verification between the FactoryTalk Service Platform service tokens and directory services. When a service token is generated, it should be cryptographically bound to a specific directory instance to prevent cross-directory token reuse. The lack of this digital signing mechanism means that tokens can be extracted from one FTSP environment and successfully used to authenticate against another FTSP directory without detection.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no privileges or user interaction. An attacker positioned on the network can:

1. Intercept or obtain a valid FTSP service token from network traffic or compromised systems
2. Identify other FTSP directory instances on the network
3. Present the captured token to a different FTSP directory
4. Gain unauthorized access to user information and system settings

Due to the lack of digital signature verification, the target directory accepts the token as valid, granting the attacker access to potentially retrieve sensitive user information and modify critical configuration settings within the industrial control environment.

Detection Methods for CVE-2024-21917

Indicators of Compromise

• Unusual authentication patterns involving service tokens being used across multiple FTSP directory instances
• Authentication events from unexpected network segments or IP addresses
• Anomalous access to user information or configuration settings without corresponding legitimate user sessions
• Service token usage patterns that deviate from established baselines

Detection Strategies

• Implement network traffic analysis to identify service token reuse across different FTSP directory endpoints
• Deploy authentication logging with correlation capabilities to detect cross-directory token authentication attempts
• Monitor for unauthorized access attempts to user directories and configuration databases
• Establish baseline authentication patterns for FTSP environments and alert on deviations

Monitoring Recommendations

• Enable detailed audit logging on all FactoryTalk Service Platform directory instances
• Implement network segmentation monitoring to detect lateral movement attempts
• Deploy intrusion detection signatures for known FTSP authentication anomalies
• Correlate authentication events across multiple FTSP directories to identify token reuse patterns

How to Mitigate CVE-2024-21917

Immediate Actions Required

• Review the Rockwell Automation Security Advisory SD1660 for vendor-specific guidance
• Implement network segmentation to isolate FTSP directory instances from untrusted networks
• Restrict network access to FTSP services using firewall rules and access control lists
• Audit current FTSP deployments to identify potentially exposed instances

Patch Information

Rockwell Automation has released security guidance addressing this vulnerability. Organizations should consult the Rockwell Automation Support Advisory SD1660 for specific patch information and update procedures. Apply all available security updates to FactoryTalk Services Platform installations as recommended by the vendor.

Workarounds

• Implement strict network segmentation between FTSP directory instances to limit token scope
• Deploy additional authentication layers where possible to supplement FTSP authentication
• Monitor and restrict network access to FTSP services to trusted endpoints only
• Consider implementing network-based intrusion prevention systems to detect and block suspicious authentication attempts

# Network segmentation recommendation - restrict FTSP access
# Example firewall rule to limit FTSP directory access to trusted management networks
# Adjust network ranges according to your environment

# Allow FTSP traffic only from trusted management subnet
iptables -A INPUT -p tcp --dport 9871 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9871 -j DROP