Bypass Authentication via SOAP API in Delinea Secret Server

CVE-2024-33891

What is CVE-2024-33891?

Delinea Secret Server prior to version 11.7.000001 contains a vulnerability that allows attackers to bypass authentication mechanisms through the SOAP API located at SecretServer/webservices/SSWebService.asmx. This security issue arises due to a hardcoded key, the use of the integer '2' for the Admin user's identification, and the improper handling of the oauthExpirationId attribute, which has been removed. Exploiting this vulnerability could allow unauthorized access to sensitive data managed within Secret Server, jeopardizing the security of an organization's credentials and access management.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References