CVE-2024-39708: Delinea Privilege Manager Escalation Flaw

CVE-2024-39708 Overview

CVE-2024-39708 is a local privilege escalation vulnerability in the Agent component of Delinea Privilege Manager (formerly Thycotic Privilege Manager) on Windows. Versions prior to 12.0.1096 are affected. A non-administrator user can plant a crafted Dynamic Link Library (DLL) in a temporary directory used by .NET Shadow Copies. When the core agent service loads that DLL, the attacker gains code execution in the context of the privileged service. The flaw is classified as [CWE-427] Uncontrolled Search Path Element, a DLL hijacking weakness. CyberArk researchers published technical analysis of the issue, and Delinea addressed it in release 12.0.1.

Critical Impact
A local low-privileged user can escalate to SYSTEM by planting a malicious DLL that the Delinea agent service loads from a writable temporary directory.

Affected Products

Delinea Privilege Manager Agent on Windows, versions before 12.0.1096
Thycotic Privilege Manager Agent (former product name), same version range
Windows endpoints running the core agent service with .NET Shadow Copy execution enabled

Discovery Timeline

2024-06-28 - CVE-2024-39708 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-39708

Vulnerability Analysis

The Delinea Privilege Manager Agent runs as a privileged Windows service. The agent is a .NET application that uses Shadow Copies, a runtime feature that copies managed assemblies to a temporary directory before loading them. The agent service searches that temporary path when resolving dependent assemblies and native DLLs.

A standard, non-administrative user can write files into the Shadow Copy directory. By placing a crafted DLL with a name the agent will resolve, the attacker causes the service to load attacker-controlled code. The loaded code executes with the SYSTEM-level privileges of the agent service. The behavior aligns with [CWE-427] Uncontrolled Search Path Element.

Exploitation is gated by attack complexity. The attacker must time the DLL drop with an assembly resolution event and target the correct file name, which is why the CVSS attack complexity is rated High. Successful exploitation grants full confidentiality, integrity, and availability impact on the host.

Root Cause

The root cause is insecure handling of the .NET Shadow Copy directory by the privileged agent process. The directory permissions allow write access to standard users, while the service trusts files resolved through its search path. No code signing or integrity validation is enforced on the loaded module before the agent maps it into the SYSTEM process.

Attack Vector

The attack vector is local. An attacker with an interactive logon or any code execution as a low-privileged user on the endpoint stages a malicious DLL in the Shadow Copy temporary directory. The attacker then triggers or waits for the agent service to perform an assembly load that resolves to the planted file. Refer to the CyberArk Threat Research Blog for the full proof-of-concept walkthrough.

No verified exploitation code is published in this advisory. The vulnerability mechanism is described in prose in the referenced CyberArk research and the Delinea Release Notes 12.0.1.

Detection Methods for CVE-2024-39708

Indicators of Compromise

Unexpected DLL files created by non-administrative users in .NET Shadow Copy directories under paths such as C:\Windows\Temp\ or user-writable %TEMP% locations referenced by the Delinea agent process.
New child processes or thread creation events originating from the Delinea agent service immediately after a DLL write event by a standard user.
Unsigned or non-Delinea-signed modules loaded into the agent service process image.

Detection Strategies

Monitor ImageLoad events for the Delinea agent service and alert when loaded modules originate from world-writable or user-writable directories.
Correlate file create events in Shadow Copy paths with subsequent module loads by the privileged agent process within a short time window.
Hunt for SYSTEM-context process creation chains parented by the Delinea agent that spawn shells, script interpreters, or LOLBins shortly after the agent starts.

Monitoring Recommendations

Enable Windows Sysmon Event ID 7 (Image loaded) and Event ID 11 (FileCreate) on hosts running Privilege Manager Agent and forward to a centralized log store.
Audit the access control lists (ACLs) on .NET Shadow Copy directories used by the agent and alert on writes from non-administrative SIDs.
Track the installed version of the Delinea agent across the fleet and flag any host still running a build older than 12.0.1096.

How to Mitigate CVE-2024-39708

Immediate Actions Required

Upgrade Delinea Privilege Manager Agent on every Windows endpoint to version 12.0.1096 or later as documented in the vendor release notes.
Inventory hosts running vulnerable agent builds and prioritize systems where untrusted users have interactive logon rights.
Restrict interactive and remote logon for non-administrative users on servers that host the Privilege Manager agent service.

Patch Information

Delinea fixed CVE-2024-39708 in Privilege Manager 12.0.1, build 12.0.1096. Patch details and upgrade instructions are published in the Delinea Release Notes 12.0.1. Apply the update through the standard Delinea update channel or by deploying the signed installer to managed endpoints.

Workarounds

If patching is delayed, harden the ACLs on the .NET Shadow Copy directory used by the agent so that only SYSTEM and Administrators can write to it.
Enable application allowlisting on endpoints to block execution of unsigned DLLs from temporary and user-writable directories.
Apply principle of least privilege and remove local logon rights for accounts that do not require interactive access to systems running the agent.

bash

# Configuration example: query installed Delinea agent version on Windows
wmic product where "Name like 'Privilege Manager Agent%%'" get Name,Version
# Expected fixed version: 12.0.1096 or later