CVE-2024-37393: SecurEnvoy MFA LDAP Injection Vulnerability

CVE-2024-37393 Overview

CVE-2024-37393 affects SecurEnvoy Multi-Factor Authentication (MFA) versions before 9.4.514. The vulnerability allows unauthenticated remote attackers to perform blind Lightweight Directory Access Protocol (LDAP) injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. Attackers can exfiltrate sensitive data from Active Directory, including the ms-Mcs-AdmPwd attribute that stores cleartext Local Administrator Password Solution (LAPS) passwords. The root cause is improper validation of user-supplied input flowing into LDAP queries [CWE-89]. Cleartext transmission of sensitive data [CWE-319] compounds the exposure.

Critical Impact
Unauthenticated remote attackers can extract Active Directory contents, including LAPS-managed local administrator passwords, enabling lateral movement and privileged access across the domain.

Affected Products

SecurEnvoy Multi-Factor Authentication Solutions versions prior to 9.4.514
The DESKTOP service exposed via the /secserver HTTP endpoint
Active Directory environments integrated with SecurEnvoy MFA for authentication

Discovery Timeline

2024-06-10 - CVE-2024-37393 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37393

Vulnerability Analysis

The vulnerability resides in the DESKTOP service component of SecurEnvoy MFA, accessible through the /secserver HTTP endpoint. User-supplied input is concatenated directly into LDAP search filters without sanitization. Attackers manipulate filter syntax to alter the intent of LDAP queries issued against the backing Active Directory.

Because the service returns boolean-style responses rather than verbose LDAP errors, the flaw constitutes a blind LDAP injection. Attackers iterate through character ranges and infer attribute values one bit at a time. This technique extracts arbitrary directory data including user attributes, group memberships, and the ms-Mcs-AdmPwd attribute used by LAPS to store local administrator passwords in cleartext within the directory.

Root Cause

The service fails to validate or escape characters with special meaning in LDAP filters such as *, (, ), \, and NUL. Input from HTTP request parameters is interpolated into filter expressions, allowing attackers to inject additional filter clauses. The application also relies on cleartext storage and transmission patterns in the LAPS attribute, which exacerbates the impact when the directory contents are leaked.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to the /secserver endpoint exposed by the DESKTOP service. Each request carries malicious LDAP filter fragments designed to elicit a true or false response from the server. By scripting a search across the alphabet for each character position, the attacker reconstructs Active Directory attribute values such as sAMAccountName, userPrincipalName, and ms-Mcs-AdmPwd. No prior credentials or user interaction are required, and the attack is conducted over the network.

The exploitation pattern follows a standard blind LDAP injection workflow. The attacker submits a probe filter that asks whether a target attribute starts with a guessed character, observes the differential response, and repeats the probe for subsequent characters until the full value is recovered. With LAPS attribute data in hand, the attacker pivots to the local administrator account on the corresponding workstation or server. See the OptiStream technical writeup for CVE-2024-37393 and the Microsoft ms-Mcs-AdmPwd attribute specification for additional context.

Detection Methods for CVE-2024-37393

Indicators of Compromise

Unauthenticated HTTP requests to the /secserver endpoint containing LDAP metacharacters such as *, (, ), or \ in parameter values
High-volume sequential requests from a single source to the DESKTOP service, indicative of character-by-character blind extraction
LDAP server logs showing repeated ldapSearch operations with filters referencing ms-Mcs-AdmPwd, sAMAccountName, or other sensitive attributes
Outbound traffic spikes from the SecurEnvoy MFA server during otherwise idle periods

Detection Strategies

Inspect HTTP access logs for the SecurEnvoy MFA server and alert on payloads containing LDAP filter syntax in query parameters or POST bodies
Correlate web requests to /secserver with downstream LDAP search activity on domain controllers to identify amplified or anomalous query patterns
Deploy web application firewall rules that decode and inspect parameters for LDAP injection signatures before they reach the DESKTOP service

Monitoring Recommendations

Enable directory service auditing on domain controllers for read operations against ms-Mcs-AdmPwd and alert on access by the SecurEnvoy service account outside expected baselines
Forward SecurEnvoy MFA application logs and domain controller events to a centralized analytics platform for correlation and retention
Monitor for unusual authentication events using local administrator accounts whose passwords are managed by LAPS, which may indicate post-exfiltration use

How to Mitigate CVE-2024-37393

Immediate Actions Required

Upgrade SecurEnvoy MFA to version 9.4.514 or later as the authoritative fix for the LDAP injection flaw
Restrict network access to the /secserver endpoint so that only required client subnets can reach the DESKTOP service
Rotate all LAPS-managed local administrator passwords if exposure of the SecurEnvoy MFA server is suspected
Reduce the privileges of the service account used by SecurEnvoy to bind to Active Directory, removing read access to ms-Mcs-AdmPwd where not strictly required

Patch Information

SecurEnvoy addressed the vulnerability in MFA version 9.4.514. Administrators should obtain the update through SecurEnvoy Support Resources and verify the installed build after deployment. No vendor advisory URL was published in the CVE record, so confirmation of the fix should be obtained directly from the vendor support channel.

Workarounds

Place the SecurEnvoy MFA server behind a reverse proxy or web application firewall that filters LDAP metacharacters from requests to /secserver
Constrain the Active Directory service account bound by SecurEnvoy to a minimal organizational unit scope so blind extraction yields no sensitive attributes
Disable or block external exposure of the DESKTOP service until the patched version is installed

bash

# Example firewall restriction limiting /secserver access to trusted subnets
iptables -A INPUT -p tcp --dport 8443 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP