WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
Published Sep 25, 2024
9.3
CRITICALCVSS 4.0
EPSS 1.17%
Description
An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components.
In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.
Affected products
-
Affected
- ≥ 12.0, ≤ 12.10.2
-
Affected
- ≥ 12.0, ≤ 12.5.4
- ≥ 12.0, ≤ 12.7
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| WatchGuard | SSO Agent | unaffected | Affected
|
| WatchGuard | SSO Client | unaffected | Affected
|
- ≤ 12.10.2
- ≤ 12.5.4
- ≤ 12.7
-
Affected
- ≥ 0, < 12.10.2
-
Affected
- ≥ 0, ≤ 12.5.4
- ≥ 0, ≤ 12.7
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| WatchGuard | Authentication Gateway | unaffected | Affected
|
| WatchGuard | Single Sign-on Client | unaffected | Affected
|
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
An attacker must have already established network access to exploit this vulnerability. WatchGuard recommends using Windows Firewall rules to restrict TCP port 4116 network access to the Single Sign-On Client to only allow connections from the Authentication Gateway (SSO Agent), and restricting TCP port 4114 network access to the Authentication Gateway to only allow connections from the Firebox. Windows administrators can use Group Policy objects to add Windows firewall rules to their endpoints.
References (4)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47657 Advisory
- https://psirt.watchguard.com/CVE-2024-6592 vendor-advisory
- https://www.redteam-pentesting.de/advisories/rt-sa-2024-006 technical-description
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014 vendor-advisoryMitigationVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47657 | Advisory | |
| https://psirt.watchguard.com/CVE-2024-6592 | vendor-advisory | |
| https://www.redteam-pentesting.de/advisories/rt-sa-2024-006 | technical-description | |
| https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014 | vendor-advisoryMitigationVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data