CVE-2024-45760: Dell OpenManage Authentication Bypass Flaw

CVE-2024-45760 is an authentication bypass vulnerability in Dell OpenManage Server Administrator that allows remote low-privileged users to perform unauthorized actions with elevated privileges via HTTP GET requests. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2024-45760 Overview

CVE-2024-45760 is an improper access control vulnerability in Dell OpenManage Server Administrator (OMSA) versions 11.0.1.0 and prior. A remote authenticated attacker with low privileges can send crafted HTTP GET requests to perform actions reserved for higher-privileged users. The weakness is classified as CWE-862: Missing Authorization and affects the OMSA web management interface used to administer Dell PowerEdge servers.

Critical Impact
A low-privileged remote user can escalate privileges over the network without user interaction, gaining full confidentiality, integrity, and availability impact on the OMSA management interface.

Affected Products

Dell OpenManage Server Administrator (OMSA) 11.0.1.0
Dell OpenManage Server Administrator (OMSA) prior versions
Dell PowerEdge servers running vulnerable OMSA builds

Discovery Timeline

2024-12-09 - CVE-2024-45760 published to NVD
2024-12-09 - Dell publishes advisory DSA-2024-481
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45760

Vulnerability Analysis

The vulnerability resides in the OMSA web server component, which exposes management endpoints over HTTPS. OMSA fails to properly enforce authorization checks on certain HTTP GET requests. An authenticated user with a low-privileged role can call functions that should be limited to administrators.

Because OMSA runs with elevated system privileges on the host, actions triggered through the flawed endpoints execute with those elevated rights. This provides a path to modify system configuration, alter hardware settings, or disrupt server availability from a standard OMSA account.

Root Cause

The root cause is missing function-level authorization ([CWE-862]) in the OMSA HTTP request handlers. The application authenticates the user session but does not consistently verify that the session holds the role required for privileged operations. Authorization logic appears to rely on client-side or contextual assumptions rather than server-side role enforcement on every request.

Attack Vector

Exploitation requires network access to the OMSA management port (default TCP 1311) and valid low-privileged credentials. The attacker sends an HTTP GET request to a privileged endpoint. Because parameters are passed via the URL query string, no complex payload construction is needed. No user interaction from an administrator is required, and attack complexity is low.

The vulnerability is described in prose only; no verified public exploit or proof-of-concept has been released. The EPSS score is 0.336%, indicating low near-term exploitation probability. See the Dell Security Update for OMSA (DSA-2024-481) for vendor technical detail.

Detection Methods for CVE-2024-45760

Indicators of Compromise

Unexpected HTTP GET requests to OMSA administrative endpoints on TCP port 1311 originating from non-administrator accounts.
OMSA audit log entries showing privileged actions (configuration changes, alert threshold edits, log clears) tied to low-privileged user sessions.
New or modified OMSA users, roles, or SNMP settings without a corresponding change request.

Detection Strategies

Correlate OMSA web access logs with role assignments to flag privileged endpoint access by non-administrator accounts.
Alert on OMSA sessions that trigger configuration or hardware-management actions shortly after authenticating with a low-privileged role.
Inventory hosts running OMSA 11.0.1.0 and prior using vulnerability management scans mapped to CVE-2024-45760.

Monitoring Recommendations

Forward OMSA and host web server logs to a centralized SIEM or data lake for cross-account correlation.
Monitor authentication events for OMSA service accounts and enable alerting on anomalous session behavior.
Track outbound configuration changes on Dell PowerEdge hardware and reconcile against change management records.

How to Mitigate CVE-2024-45760

Immediate Actions Required

Upgrade Dell OpenManage Server Administrator to the fixed version specified in Dell advisory DSA-2024-481.
Restrict network access to the OMSA management port (1311/tcp) to trusted management subnets only.
Review OMSA user accounts and remove unused or shared low-privileged accounts.
Rotate credentials for any OMSA accounts that may have been exposed.

Patch Information

Dell released a security update addressing CVE-2024-45760 in DSA-2024-481. Administrators should install the fixed OMSA build on all Dell PowerEdge servers running version 11.0.1.0 or earlier. Refer to the Dell Security Update for OMSA for the specific fixed version and installation instructions.

Workarounds

Isolate OMSA management interfaces on a dedicated management VLAN accessible only via jump hosts.
Enforce host-based firewall rules that limit access to TCP port 1311 to administrator workstations.
Where OMSA is not required, stop and disable the OMSA services until the patched version can be deployed.

bash

# Example: restrict OMSA port 1311 to a management subnet using iptables
iptables -A INPUT -p tcp --dport 1311 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1311 -j DROP

# Stop OMSA services as a temporary measure (Linux)
systemctl stop dsm_om_connsvc
systemctl disable dsm_om_connsvc