CVE-2024-54840

Executive Summary

CVE-2024-54840 is a Host header injection vulnerability affecting CyberArk Privileged Access Manager Self-Hosted, specifically the Password Vault Web Access (PVWA) component, in versions prior to 14.4. The vulnerability arises from improper validation of the HTTP Host header, allowing an attacker to manipulate the header value. This can lead to cache poisoning, password reset poisoning, and potential redirection to malicious servers, undermining the security of privileged credential management. The CVSS score is 4.2 (Medium), and while no public proof-of-concept (PoC) or exploit code is currently available, the attack vector is network-based and requires user interaction. The vendor has addressed this issue in version 14.4.

Supply Chain & Package Security

This vulnerability is not related to open-source packages (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise software product (CyberArk PAM Self-Hosted). The supply chain risk is limited to the software's internal dependencies and deployment configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – No authentication is needed to send a malicious request.
• User Interaction (UI): Required – The victim must interact with a crafted link or request.
• Scope (S): Unchanged – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited information disclosure is possible.
• Integrity (I): Low – Limited data modification is possible.
• Availability (A): None – The vulnerability does not affect system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for cache poisoning and redirection in a privileged access management context elevates the risk. An attacker could redirect users to a malicious login page to harvest credentials.

Deep Dive & Mechanics

The Host header injection vulnerability in CyberArk PVWA occurs because the application does not properly sanitize or validate the Host header in incoming HTTP requests. When a user accesses PVWA, the application may use the Host header value to generate links, redirects, or cache keys. An attacker can craft a request with a malicious Host header (e.g., Host: evil.com). If the application reflects this value in a response (e.g., in a redirect URL or a password reset link), the attacker can:

1. Cache Poisoning: If a web cache (e.g., a reverse proxy) is in front of PVWA, the attacker can poison the cache by associating a malicious response with a legitimate URL. Subsequent users may receive the poisoned response.
2. Password Reset Poisoning: If the application uses the Host header to generate password reset links, an attacker can force the link to point to their server, intercepting the reset token.
3. Open Redirect: The application may redirect users to the value in the Host header, enabling phishing attacks.

The root cause is the lack of a whitelist or strict validation for the Host header. The fix in version 14.4 likely involves validating the Host header against a list of allowed domains or using a relative path for redirects.

Vulnerable vs. Patched Code

Since the source code is proprietary, we can only infer the fix. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def generate_password_reset_link(user):
    host = request.headers.get('Host')
    return f"https://{host}/reset?token={user.token}"

The patched code would validate the host:

# Patched pseudo-code
ALLOWED_HOSTS = ['pam.company.com', 'pvwa.company.com']

def generate_password_reset_link(user):
    host = request.headers.get('Host')
    if host not in ALLOWED_HOSTS:
        host = 'pam.company.com'  # default
    return f"https://{host}/reset?token={user.token}"

Exploitation & Lab Setup

Red Team

Prerequisites:

• A CyberArk PAM Self-Hosted instance running version < 14.4.
• Network access to the PVWA web interface.
• A controlled server to receive redirected traffic (e.g., evil.com).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy (e.g., Burp Suite) to intercept a request to PVWA. Look for endpoints that reflect the Host header in responses (e.g., redirects, password reset forms).

2. Craft a malicious request: Modify the Host header to point to your server.

   GET /PasswordVault/Logon/Logon.aspx HTTP/1.1
   Host: evil.com
   User-Agent: Mozilla/5.0
   

3. Observe the response: If the application redirects to evil.com, the vulnerability is confirmed.

4. Exploit for password reset poisoning: Send a password reset request with the malicious Host header. The victim will receive a reset link pointing to evil.com.

   POST /PasswordVault/API/Auth/PasswordReset HTTP/1.1
   Host: evil.com
   Content-Type: application/json
   
   {"username": "admin"}
   

5. Intercept the reset token: When the victim clicks the link, they are redirected to your server, where you capture the token.

Blue Team

Detection:

• Monitor HTTP requests for unusual Host headers (e.g., IP addresses, external domains, or unexpected values).
• Alert on password reset requests with Host headers that do not match the expected domain.
• Use web application firewalls (WAF) to block requests with Host headers that are not in a whitelist.

Mitigation:

• Immediately upgrade to CyberArk PAM Self-Hosted version 14.4 or later.

• If upgrade is not possible, configure a reverse proxy (e.g., Nginx, Apache) to validate the Host header before forwarding to PVWA.

  # Nginx configuration to validate Host header
  server {
      listen 443 ssl;
      server_name pam.company.com;
      
      if ($host !~ ^(pam\.company\.com|pvwa\.company\.com)$ ) {
          return 444;
      }
      
      location / {
          proxy_pass http://backend;
          proxy_set_header Host $host;
      }
  }
  

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Host headers containing external domains or IP addresses.
  • Password reset requests originating from unusual IP addresses.
  • Redirect responses to domains not owned by the organization.

• Log IOCs:

  • Web server logs showing Host header values that do not match the expected domain.
  • Application logs indicating failed host validation (if logging is enabled).

• File IOCs:

  • No specific file-based IOCs are associated with this vulnerability.

Detection Engineering

YARA Rule

rule CVE_2024_54840_Host_Header_Injection {
    meta:
        description = "Detects Host header injection attempts against CyberArk PVWA"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54840"
    strings:
        $host_header = /Host:\s*(?!pam\.company\.com|pvwa\.company\.com)[^\r\n]+/ nocase
        $password_reset = /PasswordReset|passwordreset/i
        $redirect = /Location:\s*https?:\/\/[^\r\n]+/i
    condition:
        any of ($host_header) and ($password_reset or $redirect)
}

Sigma Rule

title: CyberArk PVWA Host Header Injection Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests with suspicious Host headers targeting CyberArk PVWA
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-host|re: '^(?!pam\.company\.com|pvwa\.company\.com).*$'
    condition: selection
falsepositives:
    - Legitimate changes in Host header due to proxy configuration
level: medium
tags:
    - attack.t1190
    - cve.2024.54840

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54840 CyberArk PVWA Host Header Injection"; flow:to_server; content:"Host|3a|"; nocase; pcre:"/Host:\s*(?!pam\.company\.com|pvwa\.company\.com)[^\r\n]+/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update CyberArk Privileged Access Manager Self-Hosted to version 14.4 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, implement a reverse proxy (e.g., Nginx, Apache) that validates the Host header against a whitelist of allowed domains. Reject requests with invalid headers.
3. WAF Rules: Deploy web application firewall rules to block requests with Host headers that do not match the expected pattern.

Long-Term Measures:

• Conduct a security review of all web-facing applications for similar injection vulnerabilities.
• Implement strict input validation for all HTTP headers.
• Use Content Security Policy (CSP) headers to mitigate the impact of open redirects.
• Regularly update and patch CyberArk PAM components.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your security team.