CVE-2024-37905

Executive Summary

CVE-2024-37905 is a critical privilege escalation vulnerability in Authentik, an open-source Identity Provider. The flaw resides in the API Access Token mechanism, allowing an attacker with a valid but low-privileged token to escalate their privileges to that of an admin user. A successful exploit grants full administrative control over the Authentik instance, including the ability to reset user passwords, modify policies, and access sensitive identity data. The vulnerability has been patched in versions 2024.2.4, 2024.4.2, and 2024.6.0. Given the high CVSS score of 8.8 and the potential for complete compromise of identity infrastructure, immediate patching is critical.

Supply Chain & Package Security

Authentik is distributed as a Docker image and via Python packages (PyPI). The vulnerability affects the core API token validation logic. Organizations using Authentik should verify their deployment version and ensure they are not using a vulnerable build from the official Docker Hub or PyPI repositories. The supply chain risk is moderate, as the vulnerability is in the application logic, not in a dependency, but the impact of a compromised Authentik instance is severe.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires a valid API token)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows a low-privileged user to gain full admin access. The attack complexity is low, and no user interaction is required. The impact on confidentiality, integrity, and availability is complete.

Deep Dive & Mechanics

The vulnerability is rooted in how Authentik validates API Access Tokens. The token mechanism is designed to grant specific permissions based on the token's scope. However, due to a flaw in the authorization logic, a token issued for a standard user can be manipulated or used in a way that bypasses scope restrictions, granting admin-level privileges.

Root Cause: The API endpoint responsible for token validation does not properly enforce the token's scope when processing certain administrative actions. Specifically, the token_scope attribute is not checked against the requested operation, allowing a token with a read or write scope to perform actions reserved for tokens with an admin scope.

Attack Vector: An attacker who has obtained a valid API token (e.g., through a phishing campaign, leaked credentials, or a compromised user account) can craft a request to an admin-level endpoint. The server processes the request without verifying that the token has the necessary admin scope.

Exploitation Scenario:

1. Attacker obtains a valid API token for a standard user (e.g., user@example.com).
2. Attacker sends a POST request to /api/v3/core/users/{id}/reset_password/ with the token in the Authorization header.
3. The server accepts the request because the token validation logic does not check for admin scope on this endpoint.
4. The attacker resets the password of an admin user and takes over the account.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable token validation
def validate_token(request):
    token = request.headers.get('Authorization')
    user = decode_token(token)
    # Missing scope check
    return user

Patched Code (Conceptual):

# Patched token validation
def validate_token(request, required_scope='admin'):
    token = request.headers.get('Authorization')
    user = decode_token(token)
    if required_scope not in user.token_scopes:
        raise PermissionDenied("Insufficient scope")
    return user

The patch adds a mandatory scope check before processing any admin-level API request. The required_scope parameter is set to admin for sensitive endpoints.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid API token for a non-admin user (e.g., obtained via phishing or leaked credentials).
• Network access to the Authentik API endpoint.

Exploitation Steps:

1. Identify Target: Find an Authentik instance (e.g., https://authentik.target.com).
2. Obtain Token: Use a compromised user account to generate an API token via the UI or API.
3. Escalate Privileges: Send a request to reset an admin user's password.

# Exploit: Reset admin password using a low-privilege token
curl -X POST "https://authentik.target.com/api/v3/core/users/1/reset_password/" \
  -H "Authorization: Bearer <low_priv_token>" \
  -H "Content-Type: application/json" \
  -d '{"password": "NewP@ssw0rd!"}'

4. Takeover: Log in as the admin user with the new password and gain full control.

Blue Team (Detection & Hardening)

Detection:

• Monitor API logs for requests to sensitive endpoints (e.g., /api/v3/core/users/*/reset_password/) from non-admin tokens.
• Alert on any password reset or privilege escalation action performed by a user who is not an admin.

Hardening:

• Immediately patch to version 2024.2.4, 2024.4.2, or 2024.6.0.
• Implement network segmentation to restrict API access to trusted IPs.
• Enable multi-factor authentication (MFA) for all admin accounts.
• Regularly audit API token usage and revoke unused tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API requests to /api/v3/core/users/*/reset_password/ from non-admin users.
  • Repeated failed login attempts followed by a successful password reset.
• System IOCs:
  • New admin accounts created by non-admin users.
  • Changes to Authentik policies or configurations by unexpected users.
• Log IOCs:
  • Log entries showing token_scope mismatch (e.g., read scope used on admin endpoint).
  • Audit logs with action: password_reset and actor: <non-admin user>.

Detection Engineering

YARA Rule

rule Detect_Authentik_PrivEsc_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-37905 in Authentik logs"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-37905"
    strings:
        $s1 = "/api/v3/core/users/" nocase
        $s2 = "/reset_password/" nocase
        $s3 = "Authorization: Bearer" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: Authentik Privilege Escalation via API Token
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-37905 by using a low-privilege token to reset an admin password.
author: Valters IT
date: 2024/07/01
logsource:
    category: application
    product: authentik
detection:
    selection:
        http.url|contains: "/api/v3/core/users/"
        http.url|contains: "/reset_password/"
        http.method: "POST"
    condition: selection
falsepositives:
    - Legitimate admin password resets (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37905 Authentik Privilege Escalation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/v3/core/users/"; http_uri;
    content:"/reset_password/"; http_uri;
    content:"Authorization|3a| Bearer"; http_header;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Authentik version 2024.2.4, 2024.4.2, or 2024.6.0 immediately.
2. Token Rotation: Revoke all existing API tokens and force users to generate new ones after patching.
3. Audit: Review logs for any signs of exploitation (e.g., unexpected password resets).

Long-Term Mitigations:

• Implement strict API token scope enforcement using the patched code.
• Use network policies to restrict API access to trusted IP ranges.
• Enable detailed audit logging for all admin-level API actions.
• Conduct regular security reviews of identity provider configurations.

Workaround (if patching is delayed):

• Disable API token generation for non-admin users temporarily.
• Implement a WAF rule to block requests to /api/v3/core/users/*/reset_password/ from non-admin IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence