CVE-2024-46480

Executive Summary

CVE-2024-46480 is a critical vulnerability in Venki Supravizio BPM (Business Process Management) software, affecting versions up to and including 18.0.1. The flaw allows an authenticated attacker with Application Administrator privileges to leak NTLM hashes from the underlying host system. This NTLM hash leak can be leveraged to escalate privileges on the host, potentially leading to full system compromise. The vulnerability is particularly dangerous because it requires only Application Administrator access within the BPM application, not necessarily high-level OS privileges. The CVSS score of 8.4 reflects the high impact on confidentiality, integrity, and availability, combined with a low attack complexity once the initial authentication is obtained.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby) but is a proprietary enterprise application. The risk is primarily to organizations that have deployed Venki Supravizio BPM internally. The lack of a patch or official advisory from the vendor increases the risk, as no supply chain fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
• Base Score: 8.4 (High)
• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or race conditions are required.
• Privileges Required (PR): High - The attacker must have Application Administrator access within the BPM application.
• User Interaction (UI): None - No user interaction is required.
• Scope (S): Changed - The vulnerability impacts resources beyond the vulnerable component (the host OS).
• Confidentiality (C): High - NTLM hashes are leaked, which can lead to credential theft.
• Integrity (I): High - Privilege escalation can allow modification of system files.
• Availability (A): High - Full system compromise can lead to denial of service.

Threat Level: High. The combination of network exploitability, low complexity, and high impact makes this a priority for remediation. The requirement for Application Administrator privileges reduces the attack surface but does not eliminate it, as insider threats or compromised admin accounts can exploit this.

Deep Dive & Mechanics

The vulnerability resides in how Venki Supravizio BPM handles NTLM authentication requests. When an authenticated Application Administrator interacts with certain features (likely related to system integration or reporting), the application improperly forwards NTLM authentication challenges to the client. This allows the attacker to capture the NTLM hash of the service account or the host system's machine account.

Technical Mechanism:

1. The attacker, authenticated as an Application Administrator, triggers a function that initiates an NTLM authentication handshake with a remote resource (e.g., a file share, database, or internal service).
2. The BPM application, instead of handling the authentication securely, reflects the NTLM challenge back to the attacker's client.
3. The attacker's client (e.g., a browser or a tool like Responder) captures the NTLM hash from the challenge.
4. The attacker can then crack the hash offline or use it in an NTLM relay attack to gain access to other systems.

Root Cause: The application does not properly sanitize or restrict NTLM authentication responses, allowing the hash to be leaked to the client. This is a classic NTLM reflection vulnerability, often seen in misconfigured web applications that integrate with Windows authentication.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common fixes for NTLM reflection vulnerabilities.

Vulnerable Code (Conceptual):

// Example of vulnerable code that reflects NTLM challenge
public void ProcessNtlmRequest(HttpContext context)
{
    // Directly passes the NTLM challenge from the server to the client
    string ntlmChallenge = GetNtlmChallengeFromServer();
    context.Response.Write(ntlmChallenge);
}

Patched Code (Conceptual):

// Example of patched code that blocks NTLM reflection
public void ProcessNtlmRequest(HttpContext context)
{
    // Validate that the request is not from an untrusted source
    if (!IsRequestFromTrustedSource(context))
    {
        context.Response.StatusCode = 403;
        return;
    }
    // Use a secure channel and do not expose raw NTLM data
    string ntlmChallenge = GetNtlmChallengeFromServer();
    // Encrypt or hash the challenge before sending
    string safeChallenge = ProtectNtlmData(ntlmChallenge);
    context.Response.Write(safeChallenge);
}

Key Differences:

• The patched code validates the source of the request.
• The patched code does not expose the raw NTLM challenge to the client.
• The patched code uses encryption or hashing to protect the data in transit.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Venki Supravizio BPM instance (version <= 18.0.1).
• Valid Application Administrator credentials.
• A tool to capture NTLM hashes (e.g., Responder, Inveigh, or a custom script).

Exploitation Steps:

1. Set up a listener: On the attacker machine, start an NTLM hash capture tool. For example, using Responder:

   sudo responder -I eth0 -w -r -f
   

2. Trigger the vulnerability: Log in to the Supravizio BPM application as an Application Administrator. Navigate to a feature that triggers an NTLM authentication request (e.g., a report export to a network share, or a system integration test). The application will send an NTLM challenge to the client.
3. Capture the hash: The attacker's browser or client will receive the NTLM challenge. If the attacker's machine is on the same network, Responder will capture the hash. Alternatively, the attacker can use a tool like curl with a crafted request to force the NTLM handshake.

   curl --ntlm -u "admin:password" http://target-supravizio/trigger-ntlm
   

4. Crack or relay: Use a tool like hashcat to crack the NTLM hash offline, or use an NTLM relay attack to authenticate to other services.

   hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
   

Expected Outcome: The attacker obtains the NTLM hash of the service account or machine account, which can be used to escalate privileges on the host system.

Blue Team

Detection and Response:

1. Monitor NTLM traffic: Use network monitoring tools to detect unusual NTLM authentication requests from the BPM server to clients. Look for NTLM challenges being sent to non-standard ports or IP addresses.
2. Audit Application Administrator accounts: Review all accounts with Application Administrator privileges. Ensure they are necessary and follow the principle of least privilege.
3. Harden the BPM server: Disable NTLM authentication on the server if possible, or restrict it to only trusted hosts.
4. Implement logging: Enable detailed logging on the BPM application to capture all NTLM-related events. Look for repeated NTLM challenges or failed authentication attempts.
5. Use a WAF: Deploy a Web Application Firewall (WAF) to block or alert on NTLM authentication requests that appear suspicious.

Lab Setup for Testing:

• Victim: Windows Server 2019 running Venki Supravizio BPM 18.0.1.
• Attacker: Kali Linux with Responder and hashcat.
• Network: Both machines on the same subnet to allow NTLM traffic capture.

Indicators of Compromise (IOCs)

• Network IOCs:
  • NTLM authentication requests from the BPM server to external IP addresses.
  • Unusual SMB traffic (port 445) originating from the BPM server.
  • HTTP responses containing NTLM challenge strings (e.g., NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=).
• Host IOCs:
  • Presence of NTLM hash files (e.g., ntlm_hash.txt) on the attacker's machine.
  • Unauthorized use of tools like Responder or Inveigh on the network.
• Log IOCs:
  • Event ID 4776 (Credential Validation) on Windows domain controllers showing failed NTLM authentication attempts.
  • Application logs showing repeated NTLM challenge requests from the BPM application.

Detection Engineering

YARA Rule

rule Detect_NTLM_Hash_Leak_CVE_2024_46480 {
    meta:
        description = "Detects NTLM hash leak attempts in Venki Supravizio BPM"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-46480"
    strings:
        $ntlm_header = "NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA="
        $supravizio_path = "/Supravizio/"
        $ntlm_challenge = /TlRMTVNTUAABAAAAB[0-9A-Za-z+\/]{4,}/
    condition:
        $ntlm_header or ($supravizio_path and $ntlm_challenge)
}

Sigma Rule

title: NTLM Hash Leak via Venki Supravizio BPM
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects NTLM hash leak attempts from Venki Supravizio BPM (CVE-2024-46480)
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: '/Supravizio/'
        sc-status: 200
        cs-method: 'GET'
        cs(User-Agent)|contains: 'NTLM'
    condition: selection
falsepositives:
    - Legitimate NTLM authentication from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-46480 NTLM Hash Leak Attempt"; flow:to_server,established; content:"/Supravizio/"; http_uri; content:"NTLM"; http_header; pcre:"/TlRMTVNTUAABAAAAB[0-9A-Za-z+\/]{4,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the BPM server: If possible, disconnect the server from the network until a patch is available.
2. Restrict Application Administrator access: Review and reduce the number of users with Application Administrator privileges.
3. Disable NTLM on the server: If the application does not require NTLM, disable it via Group Policy or registry settings.
4. Use a VPN: Require all administrative access to the BPM application to come through a VPN to limit exposure.

Long-term Fix:

• Vendor Patch: Await an official patch from Venki. Contact the vendor for an ETA.
• Code Fix: If source code is available, implement proper NTLM challenge handling as described in the "Vulnerable vs. Patched Code" section.
• Upgrade: If a patched version becomes available, upgrade immediately.

Workarounds:

• Network Segmentation: Place the BPM server in a separate VLAN with strict firewall rules.
• Application Whitelisting: Use AppLocker or similar to prevent unauthorized tools from running on the server.
• Monitoring: Implement the detection rules above to alert on any exploitation attempts.

Valters IT