CVE-2024-5322

Executive Summary

CVE-2024-5322 is a critical authentication bypass vulnerability in N-able N-central server when using Entra (Azure AD) SSO. The flaw allows session rebinding of already authenticated users, enabling an attacker to hijack an active session and bypass authentication entirely. With a CVSS score of 9.1, this vulnerability poses a severe risk to all Entra-supported deployments prior to version 2024.3. No public exploit code or proof-of-concept has been released, but the technical nature of the flaw makes it exploitable by skilled adversaries. Immediate patching to version 2024.3 is required.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – The victim must be authenticated and the attacker must rebind the session.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows an unauthenticated attacker to hijack an authenticated session, leading to full compromise of the N-central server and all managed endpoints.

Deep Dive & Mechanics

The vulnerability resides in the session management logic of N-central when integrated with Entra SSO. During the SSO authentication flow, the server fails to properly validate the binding between the user session and the authentication token. An attacker can intercept or manipulate the session identifier (e.g., via a man-in-the-middle attack or by exploiting a cross-site scripting flaw) and rebind it to a different authenticated user's session. This effectively allows the attacker to assume the identity of any authenticated user, including administrators.

The root cause is a missing or insufficient check of the session token's association with the authenticated user principal. The server trusts the session identifier without verifying that it corresponds to the user who originally authenticated via Entra SSO. This is a classic session fixation/rebinding vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2024.3):

// Vulnerable: Session ID is not validated against the authenticated user
public void authenticateWithSSO(String sessionId, String userToken) {
    Session session = sessionManager.getSession(sessionId);
    if (session != null && validateToken(userToken)) {
        session.setAuthenticated(true);
        session.setUser(getUserFromToken(userToken));
    }
}

Patched Code (2024.3+):

// Patched: Session ID is bound to the user token
public void authenticateWithSSO(String sessionId, String userToken) {
    Session session = sessionManager.getSession(sessionId);
    if (session != null && validateToken(userToken)) {
        String tokenUser = getUserFromToken(userToken);
        if (session.getUser() == null || session.getUser().equals(tokenUser)) {
            session.setAuthenticated(true);
            session.setUser(tokenUser);
        } else {
            throw new SecurityException("Session rebinding attempt detected");
        }
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: Access to the N-central server's network, ability to intercept or manipulate HTTP traffic (e.g., via ARP spoofing or a compromised network device).
2. Steps:
   • Wait for a legitimate user to authenticate via Entra SSO.
   • Capture the session ID from the HTTP response (e.g., Set-Cookie: JSESSIONID=abc123).
   • Create a new session with the same session ID (session fixation).
   • Send a request to the server with the captured session ID and a forged user token (or reuse the original token).
   • The server will rebind the session to the attacker's token, granting access as the victim user.
3. Expected Outcome: Full access to the N-central console with the victim's privileges.

Blue Team (Defense & Detection)

1. Monitor for Anomalous Session Activity: Look for multiple authentication events with the same session ID from different IP addresses.
2. Implement Session Binding Checks: Ensure that session IDs are cryptographically bound to the user principal and IP address.
3. Deploy Web Application Firewall (WAF) Rules: Block requests where the session ID does not match the expected user token.
4. Enable Detailed Logging: Log all session creation, authentication, and rebinding attempts.

Indicators of Compromise (IOCs)

• Network: Unusual HTTP requests with mismatched session IDs and user tokens.
• Logs: Multiple authenticateWithSSO calls with the same session ID but different user tokens.
• System: Unexpected privilege escalation or access to administrative functions by non-admin users.
• File: No specific file-based IOCs; this is a logic flaw.

Detection Engineering

YARA Rule

rule CVE_2024_5322_Session_Rebinding {
    meta:
        description = "Detects session rebinding attempts in N-central logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5322"
    strings:
        $s1 = "authenticateWithSSO" nocase
        $s2 = "sessionId" nocase
        $s3 = "userToken" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2024-5322 Session Rebinding Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential session rebinding attacks against N-central
author: Valters IT
date: 2025-04-10
logsource:
    product: n-central
    service: authentication
detection:
    selection:
        EventID: 4624
        LogonType: 10
        TargetUserName: '*'
    condition: selection
falsepositives:
    - Legitimate session renewal
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5322 N-central Session Rebinding Attempt"; flow:to_server; content:"JSESSIONID"; nocase; content:"authenticateWithSSO"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to N-central 2024.3 or later. This is the only complete fix.
2. Workaround: If patching is not possible, disable Entra SSO and use local authentication.
3. Network Segmentation: Restrict access to the N-central server to trusted IP addresses only.
4. Session Hardening: Implement additional session validation (e.g., IP binding, user-agent checks) at the network level.
5. Monitoring: Enable detailed logging and alert on any session rebinding anomalies.

Valters IT