CVE-2024-28200

Executive Summary

CVE-2024-28200 is a critical authentication bypass vulnerability in N-able N-central, a remote monitoring and management (RMM) platform. The flaw allows an unauthenticated attacker to bypass the user interface authentication, gaining unauthorized access to sensitive UI features. With a CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality and integrity, though no exploitation in the wild has been observed as of the advisory date. The vulnerability affects all deployments prior to version 2024.2. A public Nuclei template exists for detection, but no full exploit code is publicly available.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain package (NPM, PyPI, Go, Ruby). It is a direct authentication bypass in the N-central server application.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component remains the same.
• Confidentiality Impact: High (C:H) – Full access to sensitive data.
• Integrity Impact: High (I:H) – Ability to modify data or settings.
• Availability Impact: None (A:N) – No direct denial of service.
• EPSS Score: 0.53386% (Percentile: 97.99%) – Moderate probability of exploitation in the wild.

Threat Level: Critical. The combination of remote exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the authentication mechanism of the N-central web UI. The server fails to properly validate user session tokens or credentials when accessing certain UI endpoints. This allows an attacker to craft requests that bypass the login process entirely.

Root Cause: Improper enforcement of authentication checks on specific UI routes. The server trusts client-supplied session identifiers or lacks proper validation of user identity before serving restricted content.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to the N-central server. The server processes the request without verifying the user's identity, granting access to the UI.

Impact: An attacker can:

• Access sensitive configuration pages.
• View or modify managed device data.
• Potentially pivot to other internal systems.
• Disrupt RMM operations.

No known exploitation in the wild has been reported, but the public availability of a detection template increases the risk of targeted attacks.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the fix involves adding proper authentication checks to all UI endpoints.

Vulnerable Code (Conceptual):

# Vulnerable: No authentication check
@app.route('/admin/settings')
def admin_settings():
    return render_template('settings.html')

Patched Code (Conceptual):

# Patched: Authentication required
@app.route('/admin/settings')
@login_required
def admin_settings():
    return render_template('settings.html')

The patch ensures that every UI route requires a valid session or token before serving content.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running N-central < 2024.2.
• Network access to the N-central web interface (typically port 443 or 80).

Exploitation Steps:

1. Identify the target: nmap -p 443,80 <target>
2. Access the login page: https://<target>/login
3. Bypass authentication by directly accessing a restricted endpoint, e.g., https://<target>/admin/dashboard
4. If successful, the attacker gains access to the UI without credentials.

No public exploit code is available. The vulnerability is a logic flaw, not a code injection, so exploitation relies on direct access to protected routes.

Nuclei Template (Detection):

id: CVE-2024-28200

info:
  name: N-able N-central < 2024.2 - Authentication Bypass Detection
  author: rxerium
  severity: critical
  description: |
    N-central server versions prior to 2024.2 contain an authentication bypass in the user interface, letting attackers access restricted areas without proper credentials, exploit requires no specific conditions.
  impact: |
    Attackers can access sensitive user interface features, potentially leading to unauthorized data access or control.
  remediation: |
    Update to version 2024.2 or later.
  reference:
    - https://status.n-able.com/2024/07/02/n-central-critical-security-fix-details/
    - https://me.n-able.com/s/security-advisory/aArVy0000000673KAA/cve202428200-ncentral-authentication-bypass
    - https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-28200
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28200
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-28200
    cwe-id: CWE-287
    epss-score: 0.53386
    epss-percentile: 0.97993
    cpe: cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: N-able
    product: N-central
    shodan-query: http.title:"N-central Login"
  tags: cve,cve2024,n-able,ncentral,passive,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'class="ncentral"'

      - type: dsl
        dsl:
          - compare_versions(version, '< 2024.2')

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'

Blue Team (Detection & Defense)

Detection:

• Monitor for direct access to restricted UI paths (e.g., /admin/*, /config/*) without prior login.
• Look for anomalous HTTP requests with missing or invalid session cookies.
• Use the Nuclei template above to scan for vulnerable versions.

Defense:

• Immediately update to N-central 2024.2 or later.
• Restrict network access to the N-central web interface using firewalls or VPNs.
• Enable multi-factor authentication (MFA) if supported.
• Monitor logs for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /login followed by direct access to /admin/* or /config/* without a valid session.
  • Repeated 200 OK responses to restricted paths from unknown IPs.
• Host:
  • N-central version string < 2024.2 in the login page source.
  • Unusual user accounts or configuration changes.
• Logs:
  • Web server logs showing access to protected resources without prior authentication.
  • Absence of login events for sessions accessing admin areas.

Detection Engineering

YARA Rule

rule CVE_2024_28200_Ncentral_AuthBypass {
    meta:
        description = "Detects N-central versions vulnerable to CVE-2024-28200"
        author = "Valters IT"
        date = "2024-07-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28200"
    strings:
        $version_pattern = /ncentralVersion:\s*"202[0-3]\.\d+\.\d+\.\d+"/
    condition:
        $version_pattern
}

Sigma Rule

title: N-central Authentication Bypass Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to access N-central admin pages without prior authentication
author: Valters IT
logsource:
    category: webserver
    product: n-central
detection:
    selection:
        cs-uri-stem:
            - '/admin/*'
            - '/config/*'
            - '/settings/*'
        cs-method: 'GET'
        cs-cookie: ''  # No session cookie
    condition: selection
falsepositives:
    - Legitimate admin access with missing logs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28200 N-central Authentication Bypass Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/"; http_uri;
    pcre:"/^\/admin\//";
    sid:1000001;
    rev:1;
    reference:cve,2024-28200;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to N-central version 2024.2 or later. Contact N-able support for the update.
2. Workaround: If patching is not possible, restrict network access to the N-central web interface using firewall rules or a VPN.
3. Monitor: Enable detailed logging and monitor for unauthorized access attempts.

Long-Term Measures:

• Implement a vulnerability management program to ensure timely patching.
• Use network segmentation to isolate RMM systems.
• Conduct regular security audits and penetration testing.

Valters IT Signature: This report was generated by Valters IT – DevSecOps & Cyber Threat Intelligence Division.

{/* [Security Hash: 810AA9CB4A02418F3AB75DD4] */}