CVE-2024-39708: Delinea Privilege Manager Escalation Flaw

CVE-2024-39708 Overview

CVE-2024-39708 is a local privilege escalation vulnerability discovered in the Agent component of Delinea Privilege Manager (formerly Thycotic Privilege Manager) on Windows systems. The vulnerability allows a non-administrator user to achieve privilege escalation by placing a crafted DLL file in a temporary directory used by .NET Shadow Copies, which may then be loaded by the core agent service running with elevated privileges.

Critical Impact

Local privilege escalation allowing non-administrator users to gain elevated system privileges through DLL hijacking in enterprise privilege management software.

Affected Products

• Delinea Privilege Manager (Agent) before version 12.0.1096 on Windows
• Thycotic Privilege Manager (Agent) before version 12.0.1096 on Windows (former product name)

Discovery Timeline

• June 28, 2024 - CVE-2024-39708 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-39708

Vulnerability Analysis

This vulnerability represents a classic DLL hijacking attack scenario (CWE-427: Uncontrolled Search Path Element) within enterprise privilege management infrastructure. The Delinea Privilege Manager Agent, which operates with elevated system privileges to enforce security policies, contains a flaw in how it handles dynamic library loading.

The vulnerability exploits the interaction between the agent service and .NET Shadow Copy directories. These temporary directories are used by the .NET runtime for various assembly operations, but the agent service does not properly validate or restrict library loading from these locations. When a non-privileged user places a malicious DLL in the appropriate temporary directory, and conditions align for the agent service to load assemblies from that path, the crafted DLL executes with the privileges of the agent service—typically SYSTEM level.

The local attack vector requires the attacker to have initial access to the target system with low-privilege credentials. While the attack complexity is elevated due to timing and placement requirements, successful exploitation grants complete compromise of local system security controls.

Root Cause

The root cause is an uncontrolled search path element vulnerability (CWE-427) in the Delinea Privilege Manager Agent. The core agent service fails to properly restrict or validate the directories from which it loads DLL files. Specifically, the .NET Shadow Copy temporary directories used by the application are writable by lower-privileged users, and the agent service does not enforce strict path validation when loading libraries. This allows an attacker to plant a malicious DLL in a predictable location where it will be loaded by the privileged service process.

Attack Vector

The attack leverages local access with the following exploitation flow:

1. An attacker with a low-privilege user account identifies the temporary directory structure used by the Delinea Privilege Manager Agent for .NET Shadow Copies
2. The attacker crafts a malicious DLL with the expected name that the agent service attempts to load
3. The attacker copies the crafted DLL to the writable temporary directory
4. When the core agent service loads the DLL from the Shadow Copy path, the malicious code executes with SYSTEM privileges
5. The attacker achieves local privilege escalation, bypassing the very privilege management controls the software was designed to enforce

The attack requires local access and specific timing conditions, as the service must load the DLL after placement. Detailed technical analysis is available in the CyberArk Threat Research Blog.

Detection Methods for CVE-2024-39708

Indicators of Compromise

• Unexpected DLL files appearing in .NET Shadow Copy temporary directories on systems running Delinea Privilege Manager
• Unusual DLL load events from temporary paths by the Delinea Privilege Manager Agent service processes
• Anomalous child processes spawned from the Privilege Manager Agent service with unexpected behavior
• Modifications to temporary directories by non-administrative user accounts immediately before agent service activity

Detection Strategies

• Monitor file creation events in .NET Shadow Copy temporary directories, particularly for DLL files created by non-administrative users
• Implement application whitelisting to detect unsigned or unexpected DLLs being loaded by the Delinea Privilege Manager Agent processes
• Enable Windows Event Log auditing for process creation (Event ID 4688) and module loading to track DLLs loaded by privileged services
• Deploy endpoint detection rules targeting DLL sideloading patterns associated with privilege management software

Monitoring Recommendations

• Configure SentinelOne Deep Visibility to monitor DLL loading behavior of Delinea Privilege Manager Agent services
• Set up alerts for DLL files created in temporary directories that are subsequently loaded by high-privilege processes
• Review and baseline normal DLL loading behavior for the Privilege Manager Agent to establish anomaly detection thresholds
• Monitor for lateral movement attempts following any suspected privilege escalation events on affected systems

How to Mitigate CVE-2024-39708

Immediate Actions Required

• Upgrade Delinea Privilege Manager to version 12.0.1096 or later immediately on all affected Windows systems
• Audit systems for evidence of exploitation by reviewing DLL creation events in temporary directories
• Restrict write access to temporary directories used by the Privilege Manager Agent where operationally feasible
• Implement additional monitoring on systems that cannot be immediately patched

Patch Information

Delinea has addressed this vulnerability in Privilege Manager version 12.0.1096. Organizations should apply this update as soon as possible. The fix implements proper path validation and restricts the directories from which the agent service will load DLL files. Complete release notes and upgrade instructions are available in the Delinea Privilege Manager Release Notes.

Workarounds

• Implement strict file system permissions on temporary directories to prevent non-administrative users from writing DLL files
• Deploy application control policies to prevent unauthorized DLL loading by the Privilege Manager Agent service
• Use endpoint protection solutions with DLL hijacking detection capabilities to block exploitation attempts
• Consider network segmentation to limit the impact of any successful privilege escalation on affected systems

# Check current Delinea Privilege Manager Agent version
# Review installed agent version to verify patch status
wmic product where "name like '%Privilege Manager%'" get name,version

# Audit temporary directory permissions
icacls "%TEMP%" /T
icacls "%LOCALAPPDATA%\Temp" /T