CVE-2024-1591

Executive Summary

CVE-2024-1591 is a local information disclosure vulnerability in BeyondTrust Privilege Management for Windows (PM for Windows). An authenticated attacker with local access can view the Sysvol share when the product is configured to use a Group Policy Object (GPO) policy. This allows the attacker to read the policy configuration, potentially identifying misconfigurations or sensitive settings that could be leveraged for further privilege escalation or lateral movement. The vulnerability has a low CVSS score of 3.3 due to the requirement for local authentication and the limited impact of information disclosure. No public proof-of-concept or exploit code is available, and the EPSS score is 0.0%, indicating a very low probability of exploitation in the wild.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows application deployed via GPO.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Local – The attacker must have local access to the system.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker needs valid local credentials.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): Low – Only policy configuration data is exposed.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: Low. Exploitation requires local access and authentication, and the impact is limited to reading policy files.

Deep Dive & Mechanics

BeyondTrust Privilege Management for Windows allows administrators to define privilege elevation policies via Group Policy Objects (GPOs). These policies are stored in the Sysvol share on domain controllers and replicated to domain-joined machines. When PM for Windows is configured to use a GPO policy, the policy files (typically XML or ADMX/ADML) are stored in the Sysvol folder.

The vulnerability arises because, prior to version 24.1, the product does not properly restrict access to the Sysvol share for authenticated local users. An attacker with local credentials can navigate to the Sysvol share (e.g., \\domain\Sysvol\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf or similar paths) and read the policy configuration files. These files may contain sensitive information such as:

• Allowed/denied applications
• Elevation rules
• User/group SIDs
• Command-line arguments
• Other configuration details

This information can be used to identify weak policies, misconfigurations, or potential bypasses, enabling the attacker to escalate privileges or move laterally within the network.

Vulnerable vs. Patched Code

Vulnerable (pre-24.1): The product does not enforce access control on the Sysvol share for local users. The policy files are readable by any authenticated user.

Patched (24.1+): The product now restricts access to the Sysvol share, ensuring that only authorized users (e.g., administrators) can read the policy files. This is likely achieved by setting appropriate NTFS permissions or using access control lists (ACLs) on the policy files.

No code diff is available as the product is proprietary.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows machine with BeyondTrust PM for Windows installed (pre-24.1).
• Valid local credentials (low-privileged user).

Steps:

1. Log in to the target machine with low-privileged credentials.
2. Open File Explorer or a command prompt.
3. Navigate to the Sysvol share: \\<domain>\Sysvol\<domain>\Policies\
4. Browse the policy folders to find the GPO used by PM for Windows. The policy GUID can be identified by examining the registry or by trial and error.
5. Read the policy files (e.g., GptTmpl.inf, Registry.pol, or custom XML files).
6. Analyze the configuration for weak policies, such as:
   • Applications allowed to run with elevated privileges.
   • Command-line arguments that can be manipulated.
   • User/group SIDs that have excessive privileges.
7. Use this information to craft an attack (e.g., bypassing application control or escalating privileges).

Example command:

dir \\domain\Sysvol\domain\Policies\
type \\domain\Sysvol\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

Blue Team

Detection:

• Monitor for unusual access to Sysvol shares from non-administrative users.
• Enable auditing on Sysvol folder access (SACL).
• Look for repeated attempts to read policy files by low-privileged accounts.

Hunting:

• Search for Event ID 4663 (An attempt was made to access an object) with Object Name containing Sysvol and Access Mask indicating READ_CONTROL or SYNCHRONIZE.
• Correlate with user accounts that are not in the Domain Admins or Enterprise Admins groups.

Mitigation:

• Apply the vendor patch (upgrade to version 24.1 or later).
• As a workaround, restrict access to the Sysvol share using NTFS permissions or Group Policy filtering.

Indicators of Compromise (IOCs)

• File Access: Unauthorized reads of policy files in \\<domain>\Sysvol\<domain>\Policies\
• Event Logs: Event ID 4663 with Object Name containing Sysvol and Access Mask 0x1 (ReadData) or 0x20089 (READ_CONTROL).
• Process: explorer.exe or cmd.exe accessing Sysvol paths.
• Network: SMB traffic to domain controllers from non-administrative workstations.

Detection Engineering

YARA Rule

rule CVE_2024_1591_Sysvol_Access {
    meta:
        description = "Detects attempts to read Sysvol policy files by non-admin users"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1591"
    strings:
        $s1 = "\\\\*\\Sysvol\\" nocase
        $s2 = "GptTmpl.inf" nocase
        $s3 = "Registry.pol" nocase
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x4d5a) and  // PE file
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-1591 - Sysvol Policy File Access by Non-Admin User
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when a non-administrative user accesses Sysvol policy files, indicating potential exploitation of CVE-2024-1591.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1591
logsource:
    product: windows
    service: security
    category: file_access
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'Sysvol'
        AccessMask|contains: '0x1'  # ReadData
    filter:
        SubjectUserName|endswith: '$'  # Exclude machine accounts
        SubjectUserName|contains: 
            - 'Administrator'
            - 'Domain Admins'
            - 'Enterprise Admins'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access for policy management
level: medium

Suricata Rule

alert smb any any -> any 445 (msg:"CVE-2024-1591 - Sysvol Policy File Access"; content:"|5c 00 5c 00|"; distance:0; within:2; content:"Sysvol"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade BeyondTrust Privilege Management for Windows to version 24.1 or later.
2. If upgrade is not possible, restrict access to the Sysvol share by modifying NTFS permissions:
   • Remove READ access for Authenticated Users on the policy folders.
   • Grant READ access only to Domain Admins and SYSTEM.
3. Enable auditing on Sysvol to detect unauthorized access attempts.

Long-term Measures:

• Implement the principle of least privilege for all users.
• Regularly review GPO policies for misconfigurations.
• Use BeyondTrust's recommended configuration guidelines.

Workaround:

• If the product cannot be upgraded, consider using a different policy distribution method (e.g., local policies or a dedicated management server) instead of GPO.

Valters IT