CVE-2024-37742: Safe Exam Browser Auth Bypass Flaw

CVE-2024-37742 Overview

CVE-2024-37742 is an insecure access control vulnerability in Safe Exam Browser (SEB) version 3.5.0 and earlier on Windows. The flaw allows clipboard data to be shared between the SEB kiosk mode and the underlying host operating system. Attackers can exploit this weakness to bypass the lockdown controls SEB enforces during examinations. The vulnerability undermines the core security model of SEB, which is designed to isolate test-takers from external resources during proctored exams.

The issue is categorized under [CWE-284] Improper Access Control and primarily threatens exam integrity in academic and certification environments.

Critical Impact
Test-takers can extract or inject clipboard content between the locked-down SEB environment and the host system, defeating exam isolation controls and enabling cheating.

Affected Products

Safe Exam Browser (SEB) version 3.5.0 on Windows
Safe Exam Browser (SEB) versions prior to 3.5.0 on Windows
Windows host systems running SEB in kiosk mode

Discovery Timeline

2024-06-25 - CVE-2024-37742 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37742

Vulnerability Analysis

Safe Exam Browser enforces a kiosk-style lockdown on Windows endpoints during exams. The browser is intended to disable shortcuts, restrict navigation, and isolate the exam session from other applications running on the host. CVE-2024-37742 breaks this isolation by failing to sever the Windows clipboard between the kiosk session and the host operating system.

When clipboard sharing remains active, a test-taker can copy reference material outside SEB and paste it into the exam, or copy questions out of SEB into another application. This defeats the integrity guarantees expected from a secure browser product and provides an unfair advantage during high-stakes assessments.

Root Cause

The root cause is improper access control around the shared Windows clipboard subsystem. SEB does not isolate or clear the clipboard when transitioning into or out of kiosk mode. Because the clipboard is a system-wide resource, any process running outside SEB can read or write the same buffer. The vulnerability is a design and configuration weakness rather than a memory-safety flaw.

Attack Vector

Exploitation requires local interaction with a system running SEB in kiosk mode. An attacker, typically the test-taker, prepares clipboard content in a separate process before or during the exam. While SEB is active, the attacker uses standard paste operations to inject the staged content into exam answer fields. The reverse path is also possible, allowing content from inside SEB to be exfiltrated to an unmonitored process.

A public proof-of-concept demonstrating the bypass is available at the GitHub PoC Repository, with a walkthrough provided in the YouTube Security Video.

Detection Methods for CVE-2024-37742

Indicators of Compromise

Clipboard contents on the host machine that match exam questions or answers after an SEB session
Background processes such as notepad.exe, powershell.exe, or scripting hosts running concurrently with SEB
Auxiliary clipboard manager tools or scheduled tasks staging text immediately before SEB launch
SEB versions at or below 3.5.0 reported by endpoint inventory

Detection Strategies

Inventory all endpoints used for proctored exams and flag SEB versions 3.5.0 and earlier
Monitor for processes that interact with the clipboard API (OpenClipboard, GetClipboardData, SetClipboardData) while SEB is the foreground process
Correlate exam session start and end times with clipboard activity logged on the host
Review process creation logs for non-SEB applications launched during a locked-down exam window

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) on exam workstations
Deploy endpoint telemetry that captures clipboard read and write API calls
Centralize exam endpoint logs into a SIEM for correlation across cohorts and exam sittings
Alert when SEB exits unexpectedly or when foreground process changes occur mid-exam

How to Mitigate CVE-2024-37742

Immediate Actions Required

Upgrade Safe Exam Browser to a release later than 3.5.0 that addresses clipboard isolation
Reimage or re-provision shared exam workstations to remove pre-staged clipboard content
Communicate exam policy updates to proctors and require live monitoring of candidates
Audit endpoints for SEB version compliance before each exam sitting

Patch Information

No vendor advisory URL is included in the enriched data. Administrators should consult the official Safe Exam Browser release notes and update to the latest version available. Public references for this vulnerability include the GitHub PoC Repository and the YouTube Security Video.

Workarounds

Clear the Windows clipboard immediately before launching SEB using a startup script
Enforce a clean user profile or temporary local account for each exam session
Disable clipboard history and cloud clipboard via Group Policy on exam endpoints
Use remote proctoring with screen and webcam recording as a compensating control

bash

# Configuration example: clear clipboard and disable clipboard history via Group Policy
# Run before launching Safe Exam Browser on the exam endpoint

# Clear current clipboard contents
cmd /c "echo off | clip"

# Disable Windows clipboard history
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowClipboardHistory /t REG_DWORD /d 0 /f

# Disable cross-device clipboard sync
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowCrossDeviceClipboard /t REG_DWORD /d 0 /f