CVE-2024-45488

published 2024-08-30

CVE-2024-45488: One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual…

Priority P1 79 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations (VMware or HyperV). The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2.

Detection & IOCs extracted from sources · hover to see the quote

url /RSTS/UserLogin/LoginController?response_type=token&redirect_uri=https%3A%2F%2Flocalhost&loginRequestStep=6&csrfTokenTextbox=aaa↗

cookie CsrfToken=aaa; stsIdentity0=<DPAPI_BLOB>↗

other master_key: 48F4153A8C26C2B026562685B67C30EFF119D735↗

other master_key_guid: 98dc3c79-9aa5-4efc-927f-ccec24eaa14e↗

other plaintext cookie payload format: local,admin,Primary,Password,<YYYYMMDDTHHMMSSZ>,<YYYYMMDDTHHMMSSZ>↗

• → Detect authentication bypass attempts by looking for GET requests to /RSTS/UserLogin/LoginController with loginRequestStep=6 and a stsIdentity0 cookie present alongside CsrfToken=aaa. ↗
• → A successful exploit response contains both 'access_token=' and 'RelyingPartyUrl' in the JSON body with HTTP 200 and Content-Type application/json — monitor for these in responses to unauthenticated requests to the LoginController endpoint. ↗
• → The attack forges a DPAPI blob encrypted with a hardcoded AES-256/SHA-512 master key (48F4153A8C26C2B026562685B67C30EFF119D735, GUID 98dc3c79-9aa5-4efc-927f-ccec24eaa14e) and sets it as the stsIdentity0 cookie value — the presence of this specific GUID in DPAPI blobs on the wire is a strong indicator of exploitation. ↗
• → The forged cookie payload encodes the string 'local,admin,Primary,Password,' followed by timestamps — inspect stsIdentity0 cookie values (base64-decoded) for this plaintext pattern after DPAPI decryption. ↗
• → Shodan fingerprint for exposed vulnerable instances: search for html containing 'Safeguard for Privileged Passwords'. ↗

• · This vulnerability only affects virtual appliance installations (VMware or HyperV) — bare-metal deployments are not affected. ↗
• · The hardcoded master key and GUID in the PoC (48F4153A8C26C2B026562685B67C30EFF119D735 / 98dc3c79-9aa5-4efc-927f-ccec24eaa14e) are static across vulnerable installations, making the forged stsIdentity0 cookie universally applicable to unpatched virtual appliances. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.