CVE-2024-36072: Netwrix CoSoSys Endpoint Protector RCE

CVE-2024-36072 Overview

CVE-2024-36072 is a critical remote code execution vulnerability affecting Netwrix CoSoSys Endpoint Protector through version 5.9.3 and CoSoSys Unify through version 7.0.6. The vulnerability exists in the logging component of the Endpoint Protector and Unify server application, allowing an unauthenticated remote attacker to send a malicious request that results in the ability to execute system commands with root privileges.

Critical Impact

This vulnerability enables unauthenticated attackers to achieve complete system compromise with root-level command execution on affected Endpoint Protector and Unify servers.

Affected Products

• Netwrix CoSoSys Endpoint Protector through version 5.9.3
• Netwrix CoSoSys Unify through version 7.0.6
• Endpoint Protector and Unify server applications with vulnerable logging components

Discovery Timeline

• June 27, 2024 - CVE-2024-36072 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-36072

Vulnerability Analysis

This vulnerability represents a severe security flaw in the logging component of Netwrix CoSoSys Endpoint Protector and Unify server applications. The weakness is classified under CWE-779 (Logging of Excessive Data), which in this case has been exploited to enable remote code execution. The vulnerability allows unauthenticated attackers to craft and send malicious requests to the logging component, ultimately achieving arbitrary command execution with the highest level of system privileges (root).

The attack can be conducted remotely over the network without requiring any prior authentication or user interaction. An attacker who successfully exploits this vulnerability gains complete control over the affected server, with the ability to execute any system command as the root user. This level of access enables data exfiltration, lateral movement within the network, persistence establishment, and complete system compromise.

Root Cause

The root cause of CVE-2024-36072 lies in improper handling of input within the logging component of the Endpoint Protector and Unify server application. The logging mechanism fails to properly sanitize or validate user-supplied data before processing it, allowing attackers to inject malicious payloads that are subsequently executed by the system. This represents a fundamental input validation failure that, combined with the elevated privileges of the logging process, creates a direct path to root-level command execution.

Attack Vector

The attack vector is network-based, meaning attackers can exploit this vulnerability remotely without requiring local access to the target system. The exploitation process involves:

1. Target Identification: Attacker identifies an exposed Endpoint Protector or Unify server running a vulnerable version
2. Malicious Request Crafting: A specially crafted request is prepared targeting the logging component
3. Request Delivery: The malicious request is sent to the target server without any authentication
4. Command Execution: The vulnerable logging component processes the request and executes attacker-supplied commands with root privileges
5. System Compromise: Attacker achieves full control over the affected server

The vulnerability requires no authentication and no user interaction, making it highly exploitable in real-world attack scenarios. Technical details regarding specific exploitation techniques should be obtained from the Netwrix Knowledge Base Article.

Detection Methods for CVE-2024-36072

Indicators of Compromise

• Unexpected or anomalous requests to the Endpoint Protector or Unify server logging endpoints
• Evidence of command execution with root privileges from the logging service process
• Unusual network connections originating from the Endpoint Protector or Unify server
• Modification of system files or creation of new user accounts on affected servers
• Presence of web shells, backdoors, or persistence mechanisms on the server

Detection Strategies

• Monitor network traffic for suspicious requests targeting Endpoint Protector and Unify server logging components
• Implement intrusion detection rules to identify patterns consistent with command injection attempts
• Enable comprehensive logging and audit trails on all Endpoint Protector and Unify servers
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation activities
• Configure SentinelOne agents on affected servers to detect anomalous process execution patterns

Monitoring Recommendations

• Establish baseline network behavior for Endpoint Protector and Unify servers and alert on deviations
• Monitor for process execution anomalies, particularly commands spawned by the logging service
• Review authentication logs for any unexpected access attempts or privilege escalation
• Implement real-time alerting for any root-level command execution from web-facing services

How to Mitigate CVE-2024-36072

Immediate Actions Required

• Identify all Netwrix CoSoSys Endpoint Protector and Unify server installations within your environment
• Update affected systems to patched versions immediately following vendor guidance
• Restrict network access to Endpoint Protector and Unify servers using firewalls and network segmentation
• Review server logs for any indicators of prior exploitation attempts
• Implement additional monitoring and detection capabilities on affected systems

Patch Information

Netwrix has released security updates to address this vulnerability. Organizations running affected versions should consult the Netwrix Knowledge Base Article for detailed patching instructions and updated software versions. Given the critical nature of this vulnerability and the potential for unauthenticated remote code execution with root privileges, patching should be treated as an emergency priority.

Workarounds

• Implement strict network access controls to limit exposure of Endpoint Protector and Unify servers
• Place vulnerable servers behind a web application firewall (WAF) with rules to filter malicious requests
• Disable or restrict access to the logging component if operationally feasible until patches can be applied
• Monitor for exploitation attempts using intrusion detection systems while awaiting patch deployment

# Network restriction example - limit access to management interfaces
# Restrict access to Endpoint Protector server to trusted IP ranges only
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP