CVE-2024-10094

Executive Summary

CVE-2024-10094 is a critical vulnerability in Pegasystems Pega Platform, affecting versions 6.x through Infinity 24.1.1. The flaw is categorized as "Improper Control of Generation of Code" (CWE-94), which allows an unauthenticated attacker to execute arbitrary code remotely. With a CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality, integrity, and availability. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the lack of a patch makes it a high-priority target for threat actors. No public proof-of-concept (PoC) or exploit code is available, but the technical details suggest a code injection vector in the Pega Platform's request handling.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise software issue within the Pega Platform ecosystem. Organizations using Pega should treat this as a critical supply chain risk due to the lack of a vendor patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Full system compromise possible.
• Availability Impact: High (A:H) – Service disruption possible.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-tier threat. The lack of a patch increases the urgency for mitigations.

Deep Dive & Mechanics

The vulnerability resides in the Pega Platform's code generation engine, which dynamically creates and executes code based on user input. The "Improper Control of Generation of Code" (CWE-94) flaw allows an attacker to inject malicious code into the generation process, leading to remote code execution (RCE).

Technical Details:

• Affected Component: The Pega Platform's rule resolution and code generation mechanism, specifically in how it processes HTTP requests and generates Java or JavaScript code.
• Attack Vector: An unauthenticated attacker sends a specially crafted HTTP request to a vulnerable Pega endpoint. The request contains payloads that are not properly sanitized before being used in code generation.
• Exploitation Mechanism: The attacker manipulates parameters that are passed to the code generation engine. For example, a parameter like pyActivity=... or pyStream=... might be used to inject arbitrary code. The engine then compiles and executes this code on the server.
• Impact: Successful exploitation grants the attacker full control over the Pega server, including access to all data, ability to modify configurations, and potential lateral movement within the network.

Root Cause: The Pega Platform fails to validate or sanitize user-supplied input before using it in dynamic code generation. This is a classic code injection vulnerability, similar to template injection or eval() injection in other platforms.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, based on the vulnerability type, the following conceptual differences apply:

Vulnerable Code (Conceptual):

// Vulnerable: Directly using user input in code generation
String userInput = request.getParameter("code");
String generatedCode = "public class DynamicClass { public void execute() { " + userInput + " } }";
// Compile and execute generatedCode

Patched Code (Conceptual):

// Patched: Sanitize and validate user input
String userInput = request.getParameter("code");
if (!isValidInput(userInput)) {
    throw new SecurityException("Invalid input");
}
String generatedCode = "public class DynamicClass { public void execute() { " + sanitize(userInput) + " } }";
// Compile and execute generatedCode

Key Differences:

• Input Validation: Patched code includes strict validation (e.g., allowlisting allowed functions, rejecting special characters).
• Sandboxing: Patched code may execute generated code in a restricted sandbox with limited permissions.
• Parameterization: Patched code uses parameterized templates instead of string concatenation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Pega Platform instance (version 6.x to Infinity 24.1.1).
• Network access to the Pega server (typically on ports 8080 or 443).

Exploitation Steps:

1. Identify Vulnerable Endpoint: Scan for Pega endpoints like /prweb/PRServlet/, /prweb/PRRestService/, or custom rule resolution URLs.
2. Craft Payload: Inject code into a parameter that is used in code generation. Example payload for Java RCE:

   GET /prweb/PRServlet?pyActivity=Runtime&pyStream=Runtime.getRuntime().exec("cmd.exe /c calc.exe")
   

   (Note: This is a conceptual example; actual payloads may vary.)
3. Execute: Send the request. The server will generate and execute code that runs the attacker's command.
4. Post-Exploitation: Establish a reverse shell, exfiltrate data, or pivot to other systems.

Lab Setup:

• Use a Docker container with a vulnerable Pega Platform image (if available from internal archives).
• Alternatively, set up a virtual machine with Pega Platform 24.1.1 or earlier.
• Use tools like Burp Suite or curl to craft and send requests.

Blue Team (Defense)

Detection:

• Monitor for unusual HTTP requests to Pega endpoints, especially those containing Java or JavaScript code in parameters.
• Look for patterns like Runtime.getRuntime(), ProcessBuilder, or exec() in request logs.
• Use Web Application Firewall (WAF) rules to block requests with suspicious code patterns.

Hunting:

• Search for outbound connections from Pega servers to unknown IPs (potential reverse shells).
• Check for new files or processes spawned by the Pega application user.
• Review Pega logs for errors related to code compilation or execution.

Mitigation:

• If possible, disable dynamic code generation features in Pega Platform.
• Apply network segmentation to limit access to Pega servers.
• Implement strict input validation and output encoding at the application layer.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing Runtime.getRuntime(), exec(), ProcessBuilder, or similar Java execution patterns.
• Requests to Pega endpoints with unusual parameters like pyActivity, pyStream, or pyRule.
• Outbound connections from Pega servers to unknown IPs on ports 4444, 8080, or 443 (reverse shell).

File IOCs:

• Unexpected .class or .java files in Pega's temporary directories (e.g., %PEGA_HOME%/temp/).
• Modified Pega configuration files (e.g., prconfig.xml).
• New scripts or executables in the Pega installation directory.

Process IOCs:

• Unusual child processes spawned by the Pega application server (e.g., cmd.exe, powershell.exe, /bin/sh).
• High CPU or memory usage by the Pega JVM due to malicious code execution.

Log IOCs:

• Pega logs containing errors like "Compilation failed" or "SecurityException" related to code generation.
• Web server logs showing repeated requests to Pega endpoints with suspicious payloads.

Detection Engineering

YARA Rule

rule Detect_Pega_Code_Injection_CVE_2024_10094 {
    meta:
        description = "Detects potential CVE-2024-10094 exploitation attempts in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10094"
    strings:
        $java_exec = /Runtime\.getRuntime\(\)|ProcessBuilder|exec\(|\.exec\(/
        $pega_param = /pyActivity|pyStream|pyRule|pyAction/
        $code_inject = /<script|Runtime|ProcessBuilder|exec\(/
    condition:
        any of ($java_exec) and any of ($pega_param) or any of ($code_inject)
}

Sigma Rule

title: Pega Platform Code Injection Attempt (CVE-2024-10094)
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-10094 in Pega Platform
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'pyActivity'
            - 'pyStream'
            - 'pyRule'
        cs-uri-query|re: 'Runtime\.getRuntime\(\)|ProcessBuilder|exec\('
    condition: selection
falsepositives:
    - Legitimate Pega administrative actions (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10094 Pega Platform Code Injection Attempt"; flow:to_server; content:"pyActivity"; http_uri; content:"Runtime.getRuntime()"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Vulnerable Systems: If possible, disconnect Pega servers from the internet and restrict network access to trusted IPs only.
2. Apply Virtual Patching: Use WAF rules to block requests containing known code injection patterns (e.g., Runtime.getRuntime(), ProcessBuilder).
3. Monitor for Exploitation: Enable detailed logging on Pega servers and review logs for suspicious activity.

Long-Term Fixes:

1. Vendor Patch: Await an official patch from Pegasystems. Monitor their security advisories for updates.
2. Upgrade: If a patched version becomes available, upgrade to the latest Infinity release.
3. Code Review: Conduct a security audit of custom Pega applications to ensure they do not introduce similar injection vulnerabilities.
4. Input Validation: Implement strict input validation and output encoding in all Pega applications.

Workarounds:

• Disable dynamic code generation features if not required.
• Use a reverse proxy to filter malicious requests before they reach the Pega server.
• Implement network segmentation to limit the blast radius of a potential compromise.

Valters IT
Securing Digital Frontiers