CVE-2024-37393
HIGH EXPLOITED NUCLEISecurEnvoy MFA < 9.4.514 - Unauthenticated LDAP Injection via DESKTOP Service
Title source: llmExploitation Summary
CVE-2024-37393 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including noways-io. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a Python script that checks for LDAP injection vulnerability (CVE-2024-37393) in SecurEnvoy MFA by sending crafted requests and analyzing responses. It does not exploit the vulnerability but detects its presence.
Description
Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
Exploits (1)
The repository contains a Python script that checks for LDAP injection vulnerability (CVE-2024-37393) in SecurEnvoy MFA by sending crafted requests and analyzing responses. It does not exploit the vulnerability but detects its presence.
Nuclei Templates (1)
title:"SecurEnvoy"
title="SecurEnvoy"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N