CVE-2024-7061: Okta Verify Privilege Escalation Flaw

CVE-2024-7061 Overview

CVE-2024-7061 is a privilege escalation vulnerability affecting Okta Verify for Windows that allows attackers to escalate privileges through DLL hijacking. This vulnerability exploits insecure DLL loading behavior in the Okta Verify application, enabling a local attacker with limited privileges to execute arbitrary code with elevated permissions.

Critical Impact

Local attackers can leverage this DLL hijacking vulnerability to escalate privileges, potentially gaining complete control over the affected system and compromising enterprise authentication infrastructure.

Affected Products

• Okta Verify for Windows versions prior to 5.0.2

Discovery Timeline

• August 7, 2024 - CVE-2024-7061 published to NVD
• August 28, 2024 - Last updated in NVD database

Technical Details for CVE-2024-7061

Vulnerability Analysis

This vulnerability stems from insecure DLL loading practices within Okta Verify for Windows. When the application loads required dynamic link libraries, it follows a search order that can be exploited by attackers who have local access to the system. By placing a malicious DLL in a location that is searched before the legitimate system directories, an attacker can hijack the library loading process.

The vulnerability is classified under CWE-427 (Uncontrolled Search Path Element) and CWE-22 (Path Traversal), indicating that the application does not properly control the search path used to locate DLL files. This allows an attacker to substitute malicious code for legitimate libraries, which then executes with the privileges of the Okta Verify process.

Root Cause

The root cause of CVE-2024-7061 lies in the application's failure to properly specify or validate the paths from which DLLs are loaded. Windows applications that do not use absolute paths or implement proper DLL loading safeguards are susceptible to this class of attack. The Okta Verify application searches for required libraries in directories where a local user may have write permissions, enabling DLL substitution attacks.

Attack Vector

The attack requires local access to the target system with the ability to write files to specific directories in the DLL search path. An attacker would:

1. Identify the DLLs loaded by Okta Verify during execution
2. Determine writable locations in the application's DLL search order
3. Plant a malicious DLL with the same name as a legitimately loaded library
4. Wait for or trigger the Okta Verify application to load the malicious DLL
5. Achieve code execution with the privileges of the Okta Verify process

The vulnerability mechanism involves the Windows DLL search order being exploited when Okta Verify loads libraries without specifying absolute paths. For detailed technical information, refer to the Okta Security Advisory.

Detection Methods for CVE-2024-7061

Indicators of Compromise

• Unexpected DLL files appearing in Okta Verify installation directories or user-writable paths within the search order
• DLL files with legitimate names but anomalous file hashes, sizes, or digital signatures
• Process execution logs showing Okta Verify loading DLLs from non-standard locations
• Unusual privilege escalation events correlated with Okta Verify process activity

Detection Strategies

• Monitor file system changes in directories within the Okta Verify DLL search path for new or modified DLL files
• Implement application whitelisting to detect unauthorized DLLs being loaded by Okta Verify
• Use endpoint detection and response (EDR) solutions to identify suspicious DLL loading patterns and privilege escalation attempts
• Compare loaded DLL hashes against known-good baselines for the Okta Verify installation

Monitoring Recommendations

• Enable detailed Windows Security Event logging, particularly for process creation (Event ID 4688) and privilege use events
• Configure Sysmon to log DLL loading events (Event ID 7) for the Okta Verify process
• Implement file integrity monitoring on Okta Verify installation directories and common DLL hijacking paths
• Alert on any process spawning from Okta Verify with elevated privileges that deviates from normal behavior

How to Mitigate CVE-2024-7061

Immediate Actions Required

• Upgrade Okta Verify for Windows to version 5.0.2 or greater immediately
• Audit current Okta Verify installations across the enterprise to identify vulnerable versions
• Review endpoint security policies to ensure DLL hijacking protections are enabled
• Restrict write permissions to directories in the Okta Verify DLL search path where possible

Patch Information

Okta has addressed this vulnerability in Okta Verify for Windows version 5.0.2. Organizations should update to this version or later to remediate the vulnerability. Detailed patch information is available in the Okta OIE Release Notes and the Okta Security Advisory.

Workarounds

• Restrict user write permissions to directories in the Windows DLL search path, particularly application directories and user profile locations
• Implement application control policies to prevent unsigned or untrusted DLLs from loading
• Use Windows Defender Application Control (WDAC) or similar technologies to enforce code integrity policies
• Monitor and alert on DLL side-loading attempts using EDR solutions until patching can be completed

# Verify Okta Verify version and check for vulnerable installations
# PowerShell command to check installed Okta Verify version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "*Okta Verify*" } | Select-Object DisplayName, DisplayVersion