CVE-2024-33891 Overview
CVE-2024-33891 is an authentication bypass vulnerability in Delinea Secret Server versions before 11.7.000001. The flaw resides in the SOAP API exposed at SecretServer/webservices/SSWebService.asmx. Attackers can bypass authentication by abusing a hardcoded key, using the integer 2 to reference the built-in Admin user, and stripping the oauthExpirationId attribute from requests. Because Secret Server functions as a privileged access management (PAM) vault storing enterprise credentials, an unauthenticated bypass exposes secrets that unlock downstream systems. The vulnerability is categorized under [CWE-321] (Use of Hard-coded Cryptographic Key).
Critical Impact
An attacker with network access to the Secret Server SOAP endpoint can impersonate the Admin user and access every secret stored in the vault, enabling lateral movement across the enterprise.
Affected Products
- Delinea Secret Server (on-premises) versions prior to 11.7.000001
- Deployments exposing SSWebService.asmx SOAP endpoint
- Environments relying on OAuth token validation via oauthExpirationId
Discovery Timeline
- 2024-04-28 - CVE-2024-33891 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-33891
Vulnerability Analysis
Delinea Secret Server exposes a SOAP web service at SecretServer/webservices/SSWebService.asmx. This endpoint accepts authentication material that the application validates using cryptographic operations tied to a hardcoded key shipped with the product. Because the key is static and recoverable, an attacker can forge tokens that the server treats as legitimate.
The bypass depends on three chained conditions. First, the attacker forges a request signed with the hardcoded key. Second, the request references the built-in Admin identity using the integer value 2, which maps to the default administrator account in the Secret Server user table. Third, the attacker omits the oauthExpirationId attribute from the payload, which disables the token expiration check on the server side.
Once these conditions are met, the SOAP service responds with a valid administrator session, granting full read access to secrets stored in the vault. Public analysis and a proof-of-concept exploit are documented in the Medium analysis on Delinea Bypass and the GitHub PoC for CVE-2024-33891.
Root Cause
The root cause is the use of a hardcoded cryptographic key inside the Secret Server application binaries. Server-side validation logic trusts tokens signed with this key without additional binding to the requesting client. The Admin user is also referenced by a predictable integer identifier, and expiration enforcement is skipped when the oauthExpirationId attribute is missing rather than treated as invalid.
Attack Vector
The attack is remote and network-based. An attacker only needs HTTP or HTTPS reachability to the Secret Server SOAP endpoint. No prior user credentials are required to complete the bypass, and no user interaction is involved. Successful exploitation yields administrator-level access to the credential vault, which typically stores domain, database, cloud, and infrastructure secrets.
The vulnerability is described in prose above; refer to the GitHub PoC for CVE-2024-33891 for the exact request structure used in public exploitation attempts.
Detection Methods for CVE-2024-33891
Indicators of Compromise
- SOAP requests to SecretServer/webservices/SSWebService.asmx that reference user identifier 2 without a preceding interactive login session.
- SOAP request bodies where the oauthExpirationId attribute is absent or has been stripped from an otherwise well-formed payload.
- Anomalous bulk secret retrieval operations tied to the built-in Admin account originating from unusual IP addresses or user agents.
- Audit log entries showing Admin-level API activity outside expected maintenance windows.
Detection Strategies
- Inspect web server and IIS logs for POST requests to SSWebService.asmx and correlate them with Secret Server audit records for the Admin user.
- Deploy WAF or reverse proxy rules that flag SOAP requests missing the oauthExpirationId attribute.
- Baseline normal SOAP API usage per source address, then alert on new sources authenticating as Admin.
- Enable verbose Secret Server audit logging and ship events to a centralized analytics platform for correlation.
Monitoring Recommendations
- Forward Secret Server IIS and application logs to a central SIEM for continuous review and long-term retention.
- Alert on any secret retrieval spikes, especially for high-value secrets, within short time windows.
- Monitor outbound connections from the Secret Server host for evidence of secret exfiltration.
- Review privileged account activity daily until the environment is confirmed patched.
How to Mitigate CVE-2024-33891
Immediate Actions Required
- Upgrade Delinea Secret Server to version 11.7.000001 or later, as documented in the Delinea Release Notes 11.7.
- Restrict network access to the SOAP endpoint SecretServer/webservices/SSWebService.asmx to trusted administrative networks only.
- Rotate all secrets stored in Secret Server if the deployment was internet-exposed prior to patching.
- Force a password reset for the built-in Admin account and audit its recent activity.
Patch Information
Delinea addressed the flaw in Secret Server 11.7.000001. Customers should review the Delinea Trust Center Overview and the vendor release notes to confirm the correct upgrade path for their deployment model. On-premises operators must apply the update manually; cloud-hosted tenants are updated by Delinea.
Workarounds
- Block external access to SSWebService.asmx at the perimeter firewall or reverse proxy until patching is complete.
- Disable the SOAP web service if it is not required by integrations in the environment.
- Enforce IP allow-listing on the IIS site hosting Secret Server to permit only known management hosts.
- Enable multi-factor authentication for all interactive Secret Server accounts to reduce exposure of harvested credentials.
Configuration guidance is available in the Delinea Release Notes 11.7; apply upgrade steps according to your deployment topology.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
