CVE-2024-41915: ClearPass Policy Manager SQLi Vulnerability

CVE-2024-41915 Overview

CVE-2024-41915 is a SQL injection vulnerability in the web-based management interface of Aruba Networks ClearPass Policy Manager. An authenticated remote attacker can inject malicious SQL statements through the management interface to interact with the underlying database. Successful exploitation allows attackers to read and modify sensitive data, escalate privileges within the policy engine, and potentially compromise the entire ClearPass Policy Manager cluster. The flaw is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
An authenticated attacker with low privileges can achieve full read/write access to the ClearPass database, leading to complete cluster compromise and exposure of network access control policies, credentials, and authentication records.

Affected Products

Aruba Networks ClearPass Policy Manager (network access control platform)
ClearPass Policy Manager cluster deployments exposing the web-based management interface
Environments referenced in the HPE Aruba security bulletin hpesbnw04675en_us

Discovery Timeline

2024-07-30 - CVE-2024-41915 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41915

Vulnerability Analysis

The vulnerability resides in the web-based management interface of ClearPass Policy Manager, which is Aruba's centralized policy engine for network access control (NAC), guest access, and BYOD onboarding. An authenticated attacker submits crafted input to a management endpoint that is concatenated into a backend SQL query without proper parameterization or sanitization.

Because ClearPass acts as the authoritative store for authentication policies, RADIUS/TACACS+ configurations, and endpoint attributes, a successful SQL injection has downstream impact across the entire authenticated network. Attackers can query stored credentials, alter policy tables, or plant persistence that survives operator remediation. The advisory notes potential compromise of the full ClearPass Policy Manager cluster, indicating that injected statements execute with sufficient database privileges to affect clustered data replication.

Root Cause

The root cause is improper neutralization of user-supplied input in SQL statements executed by the management interface. Input flowing from authenticated HTTP requests reaches SQL query construction without prepared statements or strict input validation, matching the classic [CWE-89] pattern.

Attack Vector

Exploitation requires network reachability to the ClearPass management interface and valid authenticated credentials with low privileges. The attacker submits SQL metacharacters through a vulnerable parameter in the management UI or its underlying APIs. The injected payload executes in the ClearPass database context, allowing data extraction using UNION-based, error-based, or time-based techniques, and data modification through INSERT, UPDATE, or DELETE statements.

No verified public exploit code is available at the time of writing, and the EPSS score reflects moderate near-term exploitation likelihood. See the HPE Aruba security advisory for the authoritative technical description.

Detection Methods for CVE-2024-41915

Indicators of Compromise

Authenticated management-interface requests containing SQL metacharacters such as ', --, ;, UNION SELECT, or SLEEP( in parameter values.
Unexpected outbound connections or large response payloads originating from the ClearPass management interface following authenticated sessions.
Unexplained modifications to ClearPass policy, endpoint, or local user tables that do not correspond to administrator activity in audit logs.
New or modified administrator accounts, guest accounts, or role mappings created outside change-control windows.

Detection Strategies

Enable and centralize ClearPass application and audit logs, then alert on SQL error responses returned to authenticated management sessions.
Deploy a web application firewall or reverse proxy in front of the management interface with signatures for SQL injection payloads targeting ClearPass endpoints.
Correlate low-privileged administrative logins with atypical query patterns, database errors, or long-running requests indicative of time-based injection.

Monitoring Recommendations

Ingest ClearPass syslog, audit, and access logs into a central analytics platform and retain them for at least 90 days to support retrospective investigation.
Monitor authentication policy tables and administrator account changes for integrity, and alert on unauthorized modifications.
Track management-interface access by source IP and account, and flag access from networks that should not reach the management plane.

How to Mitigate CVE-2024-41915

Immediate Actions Required

Apply the fixed ClearPass Policy Manager version identified in the HPE Aruba security bulletin hpesbnw04675en_us.
Restrict access to the ClearPass web management interface to a dedicated management VLAN or jump-host network, and block it from user and guest networks.
Rotate ClearPass local administrator, operator, and API credentials, and review recent audit logs for suspicious authenticated activity.
Enforce least privilege on ClearPass administrative roles so that day-to-day operators cannot reach the vulnerable management functions.

Patch Information

HPE Aruba Networking has released fixed versions of ClearPass Policy Manager addressing CVE-2024-41915. Refer to the HPE Aruba security advisory for the exact fixed builds corresponding to each supported branch, and follow standard cluster upgrade procedures to ensure all publisher and subscriber nodes are updated.

Workarounds

Limit management-interface exposure to a hardened administrative subnet using firewall access control lists until patching is complete.
Require multi-factor authentication and strong password policies for all ClearPass administrative accounts to raise the barrier for the required authenticated access.
Disable or remove unused administrator, operator, and API accounts to reduce the attack surface reachable by a low-privileged foothold.

bash

# Example: restrict ClearPass management interface access at the network edge
# Replace interface, ACL name, and management subnet with values for your environment
ip access-list extended CLEARPASS-MGMT-ACL
 permit tcp 10.10.20.0 0.0.0.255 host <clearpass-mgmt-ip> eq 443
 deny   tcp any host <clearpass-mgmt-ip> eq 443 log
 permit ip any any
!
interface GigabitEthernet0/1
 ip access-group CLEARPASS-MGMT-ACL in