CVE-2024-22454: Dell PowerProtect Data Manager Auth Bypass

CVE-2024-22454 Overview

CVE-2024-22454 affects Dell PowerProtect Data Manager version 19.15 and prior versions. The product contains a weak password recovery mechanism for forgotten passwords [CWE-640]. A remote unauthenticated attacker can retrieve the password reset token without authorization and then complete the password change workflow. Successful exploitation grants unauthorized access to the application with the privileges of the compromised account.

Dell published the vulnerability under advisory DSA-2024-061. The flaw carries network attack vector with low complexity and requires user interaction.

Critical Impact

Remote unauthenticated attackers can hijack accounts in Dell PowerProtect Data Manager by abusing the password reset workflow, leading to unauthorized application access at the privilege level of the victim account.

Affected Products

• Dell PowerProtect Data Manager version 19.15
• Dell PowerProtect Data Manager versions prior to 19.15
• Backup and recovery deployments that rely on the affected forgotten password workflow

Discovery Timeline

• 2024-02-13 - CVE-2024-22454 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22454

Vulnerability Analysis

The weakness sits in the forgotten password workflow of Dell PowerProtect Data Manager. The application generates a password reset token but exposes it through a flow that does not properly enforce authorization. A remote attacker can request a reset for a target account and retrieve the associated token without holding valid credentials.

Once the attacker obtains the token, they can submit a password change request and set a new password for the targeted account. The attack does not require prior access to the victim mailbox or session. The result is full account takeover at the privilege level of the chosen victim, including administrative accounts.

PowerProtect Data Manager centralizes backup orchestration for enterprise workloads. Compromise of a privileged account exposes backup catalogs, retention policies, and restore operations to manipulation.

Root Cause

The root cause is improper restriction of access to the password reset token, classified under [CWE-640] Weak Password Recovery Mechanism for Forgotten Password. The reset workflow fails to bind the token to an authenticated channel or to a recipient-controlled secret, allowing an unauthenticated requester to read or predict it.

Attack Vector

The attack vector is network based. An attacker reaches the PowerProtect Data Manager web interface, initiates a password reset for a target account, retrieves the token through the flawed mechanism, and posts the new password. The vector requires user interaction in the scoring, but exploitation does not require valid credentials.

No public proof-of-concept or exploit code is listed in public exploit databases for this CVE. Refer to the Dell Security Advisory DSA-2024-061 for vendor technical details.

// No verified proof-of-concept code is publicly available for CVE-2024-22454.
// Exploitation involves abusing the forgotten-password endpoint to obtain a
// reset token for an arbitrary account and submitting a password change request.

Detection Methods for CVE-2024-22454

Indicators of Compromise

• Password reset requests targeting administrative or service accounts in PowerProtect Data Manager that the legitimate account owner did not initiate.
• Successful password change events followed by logins from unfamiliar source IP addresses or geolocations.
• Audit log entries showing account profile or role changes shortly after a reset.

Detection Strategies

• Correlate forgot password HTTP requests with subsequent password change requests from the same source IP within short time windows.
• Alert on password resets for privileged PowerProtect Data Manager accounts and require out-of-band confirmation.
• Monitor for repeated reset requests against multiple accounts from a single source, which can indicate enumeration.

Monitoring Recommendations

• Forward PowerProtect Data Manager web and audit logs to a centralized SIEM for correlation with authentication telemetry.
• Track backup job modifications, retention policy changes, and restore operations performed after any password reset event.
• Review session activity for accounts that recently used the password recovery workflow.

How to Mitigate CVE-2024-22454

Immediate Actions Required

• Upgrade Dell PowerProtect Data Manager to the fixed version identified in Dell Security Advisory DSA-2024-061.
• Restrict network access to the PowerProtect Data Manager management interface to trusted administrative networks.
• Force password rotation for all administrative and service accounts after applying the patch.

Patch Information

Dell addresses the issue in the update referenced in advisory DSA-2024-061. Administrators should consult the advisory for fixed version numbers, upgrade procedures, and any prerequisites for the PowerProtect Data Manager appliance. Apply the update following Dell's documented upgrade path and validate backup and restore operations after patching.

Workarounds

• Place the PowerProtect Data Manager web interface behind a VPN or jump host to block unauthenticated internet exposure.
• Disable or tightly monitor the forgotten password workflow until the patch is applied where operationally feasible.
• Enforce multi-factor authentication on upstream identity providers integrated with PowerProtect Data Manager.

# Example: restrict access to PowerProtect Data Manager UI to an admin subnet
# Replace 10.10.50.0/24 with your administrative management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP