CVE-2024-51772: ClearPass Policy Manager RCE Vulnerability

CVE-2024-51772 Overview

CVE-2024-51772 is an authenticated remote code execution (RCE) vulnerability in the Aruba ClearPass Policy Manager web-based management interface. The flaw allows a remote authenticated user to execute arbitrary commands on the underlying operating system of the ClearPass host. The vulnerability is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command). ClearPass Policy Manager is Hewlett Packard Enterprise (HPE) Aruba Networking's network access control (NAC) platform, so successful exploitation can compromise the trust anchor for enterprise wired, wireless, and VPN authentication.

Critical Impact
An authenticated attacker with low privileges can run arbitrary operating system commands on the ClearPass appliance, potentially exposing RADIUS secrets, certificates, and downstream network access decisions.

Affected Products

HPE Aruba Networking ClearPass Policy Manager (see vendor advisory for affected version ranges)
ClearPass Policy Manager web-based management interface
Deployments exposing the ClearPass admin UI to authenticated users

Discovery Timeline

2024-12-03 - CVE-2024-51772 published to the National Vulnerability Database
2024-12-03 - HPE publishes security advisory hpesbnw04761en_us
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51772

Vulnerability Analysis

The vulnerability resides in the ClearPass Policy Manager web management interface. An authenticated user can submit crafted input that reaches an operating system command execution path without proper neutralization of shell metacharacters. Because ClearPass runs as a privileged appliance service, injected commands execute in the security context of the underlying host operating system. Exploitation requires valid credentials and some user interaction, but does not require administrator-level privileges on the appliance. The impact spans confidentiality, integrity, and availability, since command execution on a policy decision point can leak RADIUS shared secrets, TLS private keys, and local credential stores used to authorize network access.

Root Cause

The root cause is improper neutralization of special elements passed to an OS command, classified as CWE-77. A user-controlled parameter in the management interface is concatenated into a shell command without sufficient input validation or safe argument passing. HPE has not published low-level technical details identifying the specific endpoint or parameter.

Attack Vector

The attack vector is network-based against the ClearPass administrative web interface. The attacker must first authenticate to the management console. After authentication, the attacker submits a crafted request containing command metacharacters through the vulnerable interface component. The injected payload is passed to a shell interpreter on the appliance, resulting in arbitrary command execution as the ClearPass service user. Consult the HPE Security Advisory for the specific affected components and fixed versions. No public proof-of-concept exploit has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-51772

Indicators of Compromise

Unexpected child processes spawned by the ClearPass web application service, such as sh, bash, nc, curl, wget, or python.
New or modified files under ClearPass configuration and log directories that do not correlate with an operator-initiated change.
Outbound network connections from the ClearPass appliance to untrusted hosts on non-standard ports.

Detection Strategies

Enable and forward ClearPass admin UI access logs and audit logs to a central log platform, and alert on administrative sessions that submit unusual parameter values containing shell metacharacters such as ;, |, &&, or backticks.
Correlate authenticated administrative activity with process execution telemetry on the ClearPass host to detect command execution that follows a suspicious API or form submission.
Baseline normal ClearPass administrator behavior and alert on privileged actions occurring outside change windows or from unexpected source IP addresses.

Monitoring Recommendations

Monitor management-plane traffic to ClearPass for requests originating from network segments that should not host administrators.
Track failed and successful authentication events to the ClearPass admin UI and alert on brute force or credential stuffing patterns that could precede exploitation.
Review scheduled tasks, cron jobs, and startup scripts on the appliance for unauthorized modifications after any suspicious admin session.

How to Mitigate CVE-2024-51772

Immediate Actions Required

Apply the fixed ClearPass Policy Manager release identified in the HPE Security Advisory as soon as maintenance windows allow.
Restrict access to the ClearPass web management interface to a dedicated management network or jump host, and block it from general user VLANs and the internet.
Rotate ClearPass local administrator passwords, API tokens, RADIUS shared secrets, and TLS private keys on any appliance suspected of exposure.

Patch Information

HPE has published fixed software versions for ClearPass Policy Manager in advisory hpesbnw04761en_us. Refer to the HPE Security Advisory for the exact affected and patched build numbers that apply to your deployment. Upgrade all cluster members, including publisher and subscriber nodes, to a fixed release.

Workarounds

Enforce network access control lists that limit the ClearPass admin interface to a small set of trusted administrator source addresses.
Require multi-factor authentication for all ClearPass administrator accounts to raise the cost of credential compromise that precedes exploitation.
Reduce the number of accounts with access to the ClearPass management UI and audit remaining accounts for least-privilege role assignment.

bash

# Example: restrict access to the ClearPass admin UI at the network edge
# Replace 10.10.20.0/24 with your management network CIDR
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP