CVE-2024-23464

Executive Summary

CVE-2024-23464 is a high-severity vulnerability (CVSS 7.2) affecting the Zscaler Client Connector for Windows prior to version 4.2.1. The flaw allows a local attacker with administrative privileges to disable the Zscaler Internet Access (ZIA) security agent using PowerShell commands. This effectively bypasses the organization's web security policy, potentially exposing the endpoint to malicious traffic and data exfiltration. The vulnerability stems from improper access control (CWE-284) where the ZIA service does not adequately protect its own process or configuration from being terminated or altered by a privileged local user.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a client-side software flaw in a proprietary security product. The risk is primarily to enterprise endpoints where Zscaler Client Connector is deployed as a security agent.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – Administrative rights are needed.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – The attacker can disable security controls, leading to potential data exposure.
• Integrity (I): High (H) – The attacker can disable the security agent, compromising the integrity of the security posture.
• Availability (A): High (H) – The attacker can disable the ZIA service, making it unavailable.

Threat Level: High. While the attack requires local admin rights, this is a common privilege in many enterprise environments. The impact is severe as it completely disables the primary web security control.

Deep Dive & Mechanics

The vulnerability lies in the Zscaler Client Connector's inability to prevent a local administrator from stopping or disabling the ZIA service via PowerShell. The ZIA service runs with SYSTEM privileges, but a local admin can use commands like Stop-Service, Set-Service, or sc.exe to manipulate the service state. The software does not implement sufficient protections such as:

• Service ACLs that prevent non-SYSTEM processes from stopping the service.
• Process protection flags (e.g., PROCESS_TERMINATE access restrictions).
• Kernel-mode callbacks to detect and prevent service termination.

An attacker with admin rights can execute:

Stop-Service -Name "ZscalerService" -Force

or

Set-Service -Name "ZscalerService" -StartupType Disabled

This immediately disables web filtering, SSL inspection, and all other ZIA security features, leaving the endpoint unprotected.

Vulnerable vs. Patched Code

Vulnerable (pre-4.2.1): The ZIA service does not enforce strict service-level ACLs. A local admin can stop or disable the service using standard Windows service control commands.

Patched (4.2.1+): Zscaler has implemented service hardening, likely by:

• Modifying the service's security descriptor to deny SERVICE_STOP and SERVICE_CHANGE_CONFIG permissions to non-SYSTEM accounts, even if they are administrators.
• Adding a watchdog process that restarts the service if it is terminated.
• Using Windows Filtering Platform (WFP) or a kernel driver to block attempts to stop the service.

No specific code diff is publicly available, but the patch focuses on preventing unauthorized service manipulation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local administrative privileges on a Windows endpoint running Zscaler Client Connector <4.2.1.
• PowerShell or command prompt access.

Exploitation Steps:

1. Open PowerShell as Administrator.
2. Identify the Zscaler service name:

   Get-Service -Name "*Zscaler*"
   

   Typical name: ZscalerService or ZIA.
3. Stop the service:

   Stop-Service -Name "ZscalerService" -Force
   

4. (Optional) Disable the service to prevent automatic restart:

   Set-Service -Name "ZscalerService" -StartupType Disabled
   

5. Verify the service is stopped:

   Get-Service -Name "ZscalerService"
   

6. The ZIA agent is now disabled. The endpoint can now bypass web filtering and SSL inspection.

Alternative Method (sc.exe):

sc stop ZscalerService
sc config ZscalerService start= disabled

Blue Team (Detection & Hardening)

Detection:

• Monitor for Stop-Service or Set-Service commands targeting Zscaler services.
• Alert on service state changes for ZscalerService or ZIA.
• Use Sysmon Event ID 1 (Process Creation) to detect sc.exe or powershell.exe with arguments containing ZscalerService.

Hardening:

• Apply the patch by upgrading to version 4.2.1 or later.
• Implement Application Control (e.g., AppLocker, WDAC) to block unauthorized PowerShell usage by non-approved users.
• Restrict local admin rights to only necessary personnel.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block PSExec and WMI service manipulation.
• Use Group Policy to enforce service ACLs that prevent non-SYSTEM accounts from stopping critical security services.

Indicators of Compromise (IOCs)

• Service Name: ZscalerService or ZIA
• PowerShell Commands:
  • Stop-Service -Name "ZscalerService" -Force
  • Set-Service -Name "ZscalerService" -StartupType Disabled
• sc.exe Commands:
  • sc stop ZscalerService
  • sc config ZscalerService start= disabled
• Event Logs:
  • Windows System Event ID 7036 (Service state change) for ZscalerService.
  • Windows Security Event ID 4688 (Process Creation) with powershell.exe or sc.exe and arguments containing ZscalerService.
• Registry Changes:
  • HKLM\SYSTEM\CurrentControlSet\Services\ZscalerService\Start changed to 4 (Disabled).

Detection Engineering

YARA Rule

rule CVE_2024_23464_Zscaler_Disable {
    meta:
        description = "Detects attempts to disable Zscaler Internet Access service via PowerShell or sc.exe"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-23464"
        severity = "high"
    strings:
        $ps_stop = "Stop-Service" nocase
        $ps_set = "Set-Service" nocase
        $sc_stop = "sc stop" nocase
        $sc_config = "sc config" nocase
        $zscaler = "ZscalerService" nocase
        $zia = "ZIA" nocase
    condition:
        (any of ($ps_stop, $ps_set, $sc_stop, $sc_config)) and (any of ($zscaler, $zia))
}

Sigma Rule

title: Zscaler Internet Access Service Disable Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to stop or disable the Zscaler Internet Access service via PowerShell or sc.exe
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23464
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\sc.exe'
        CommandLine|contains:
            - 'ZscalerService'
            - 'ZIA'
        CommandLine|contains:
            - 'Stop-Service'
            - 'Set-Service'
            - 'stop'
            - 'config'
    condition: selection
falsepositives:
    - Legitimate administrative actions by authorized IT staff
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.001

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23464 Zscaler Service Disable Attempt"; flow:to_server,established; content:"Stop-Service"; nocase; content:"ZscalerService"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-based detection of PowerShell commands sent over the network (e.g., via WinRM). Local execution is better detected via EDR/Sigma.

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Zscaler Client Connector for Windows to version 4.2.1 or later.
2. Workaround: If patching is not immediately possible, implement strict application control to prevent unauthorized PowerShell and sc.exe usage by non-IT staff.
3. Monitor: Enable enhanced logging for service state changes and process creation events related to Zscaler services.

Long-Term Mitigations:

• Enforce the principle of least privilege (PoLP) for local admin accounts.
• Use Windows Defender Application Control (WDAC) to block untrusted scripts.
• Deploy EDR solutions that can detect and block service manipulation attempts.
• Regularly audit service ACLs for critical security software.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.