CVE-2024-36037

Executive Summary

CVE-2024-36037 is a local information disclosure vulnerability in Zoho ManageEngine ADAudit Plus, affecting versions 7260 and below. The flaw allows an unauthorized local agent machine user to view session recordings, which are typically sensitive audit logs. This vulnerability has a CVSS score of 5.5 (Medium), with a low attack complexity and no user interaction required, but it requires local access to the agent machine. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild, but the lack of a confirmed patch makes it a significant concern for organizations using this software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – The attacker must have local access to the agent machine.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs low-level privileges on the agent machine.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Session recordings can contain sensitive data.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires local access, limiting its exploitability, but the potential exposure of sensitive session recordings makes it a serious insider threat.

Deep Dive & Mechanics

The vulnerability resides in the session recording storage mechanism of Zoho ManageEngine ADAudit Plus. The software records user sessions for auditing purposes and stores these recordings on the local agent machine. Due to improper access controls, any user with local access to the agent machine can view these recordings, even if they are not authorized to do so.

The root cause is a missing or insufficient authorization check when accessing the session recording files. The recordings are likely stored in a directory with weak permissions (e.g., world-readable) or accessible via a local service that does not enforce authentication. An attacker with local access can simply navigate to the storage path and view or copy the recordings.

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The attack vector is local, meaning the attacker must already have a foothold on the agent machine, but the low privileges required make it a viable post-exploitation technique.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, based on the vulnerability description, the fix would involve implementing proper access controls on the session recording storage.

Vulnerable Code (Conceptual):

# Vulnerable: No access control on session recording files
import os
def get_session_recording(session_id):
    file_path = f"/var/adaudit/recordings/{session_id}.mp4"
    # No permission check
    return open(file_path, 'rb').read()

Patched Code (Conceptual):

# Patched: Enforce authorization before access
import os
def get_session_recording(session_id, user):
    if not is_authorized(user, session_id):
        raise PermissionError("Unauthorized access")
    file_path = f"/var/adaudit/recordings/{session_id}.mp4"
    return open(file_path, 'rb').read()

The patched version would include an authorization check to ensure only authorized users can access the recordings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a machine running Zoho ManageEngine ADAudit Plus version 7260 or below.
• Low-privileged user account on the agent machine.

Exploitation Steps:

1. Identify the storage location of session recordings. This is typically in the installation directory, e.g., C:\Program Files\ManageEngine\ADAudit Plus\recordings\ on Windows or /opt/ManageEngine/ADAudit/recordings/ on Linux.
2. List the contents of the recordings directory:

   ls -la /opt/ManageEngine/ADAudit/recordings/
   

3. View a session recording file:

   cat /opt/ManageEngine/ADAudit/recordings/session_2024-05-01_10-30-00.mp4
   

4. Copy the recording to an external location for exfiltration:

   cp /opt/ManageEngine/ADAudit/recordings/session_*.mp4 /tmp/exfil/
   

Expected Outcome: The attacker gains access to sensitive session recordings, potentially containing credentials, internal communications, or other confidential data.

Blue Team

Detection Steps:

1. Monitor for unauthorized access to the recordings directory using file integrity monitoring (FIM).
2. Audit local user accounts and restrict access to the agent machine.
3. Implement least privilege principles to ensure only authorized users can access the recordings.

Hunting Queries:

• Windows Event Log: Look for Event ID 4663 (An attempt was made to access an object) with Object Name containing "recordings".
• Linux Auditd: Search for ausearch -k recordings to find access attempts to the recordings directory.

Indicators of Compromise (IOCs)

• File Paths:
  • C:\Program Files\ManageEngine\ADAudit Plus\recordings\*.mp4
  • /opt/ManageEngine/ADAudit/recordings/*.mp4
• Process Names:
  • ADAuditPlus.exe (Windows)
  • adaudit (Linux)
• Network Connections: None specific to this vulnerability.
• Registry Keys (Windows):
  • HKLM\SOFTWARE\ManageEngine\ADAudit Plus\RecordingsPath

Detection Engineering

YARA Rule

rule CVE_2024_36037_Session_Recording_Access {
    meta:
        description = "Detects access to Zoho ManageEngine ADAudit Plus session recordings"
        author = "Valters IT"
        date = "2024-05-01"
        reference = "CVE-2024-36037"
    strings:
        $s1 = "recordings" nocase
        $s2 = ".mp4" nocase
        $s3 = "ADAudit" nocase
    condition:
        all of them
}

Sigma Rule

title: Unauthorized Access to ADAudit Plus Session Recordings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to access session recording files by unauthorized users
author: Valters IT
date: 2024-05-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36037
logsource:
    category: file_access
    product: windows
detection:
    selection:
        Image|endswith: '\ADAuditPlus.exe'
        TargetFilename|contains: '\recordings\'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-36037 - Unauthorized Access to ADAudit Plus Recordings"; flow:to_server; content:"recordings"; nocase; content:".mp4"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Limit physical and remote access to agent machines running ADAudit Plus.
2. File Permissions: Manually set restrictive permissions on the recordings directory (e.g., chmod 700 on Linux or remove "Everyone" permissions on Windows).
3. Monitor Logs: Enable auditing on the recordings directory to detect unauthorized access attempts.

Long-term Fix:

• Apply the official patch from Zoho when it becomes available. Monitor Zoho's security advisory page for updates.
• Consider upgrading to a version beyond 7260 if a patched version is released.

Workaround:

• Disable session recording if not critical to operations, or move recordings to a secure, access-controlled location.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.