CVE-2024-9313Published: Oct 3, 2024 / Updated: 47d ago
Summary
A vulnerability in the Authd PAM module versions prior to 0.3.5 allows broker-managed users to impersonate any other user managed by the same broker. This impersonation can be used to perform any PAM operation, including authentication, as the impersonated user.
Impact
This vulnerability has a high severity impact with a CVSS score of 8.8. Attackers with low privileges can exploit this flaw to gain unauthorized access to user accounts managed by the same broker. This can lead to: 1. Unauthorized authentication: Malicious users can log in as other users without knowing their credentials. 2. Privilege escalation: Lower-privileged users could potentially impersonate users with higher privileges. 3. Data breach: Confidential information belonging to impersonated users could be accessed and exfiltrated. 4. System compromise: Depending on the impersonated user's permissions, attackers could potentially gain control over critical system functions. The vulnerability affects all three main aspects of information security: confidentiality, integrity, and availability.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in Authd PAM module version 0.3.5. Users should upgrade to this version or later to mitigate the risk.
Mitigation
1. Immediate patching: Upgrade the Authd PAM module to version 0.3.5 or later as soon as possible. 2. Access control review: Conduct a thorough review of user access rights and permissions, especially for broker-managed users. 3. Monitoring: Implement enhanced monitoring for authentication attempts and user activities, particularly for broker-managed accounts. 4. Least privilege principle: Ensure that all users, especially those managed by brokers, have only the minimum necessary permissions. 5. Multi-factor authentication: If not already in place, consider implementing multi-factor authentication to add an extra layer of security. 6. Audit logs: Review and analyze authentication logs for any suspicious activities that might indicate exploitation of this vulnerability. 7. Network segmentation: If possible, isolate systems using the affected Authd PAM module until patching can be completed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-9313
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-9313. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.6%)
Detection for the vulnerability has been added to Qualys (757378)
Detection for the vulnerability has been added to Nessus (210390)