CVE-2024-12356
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
Description
CVE-2024-12356 is a critical command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products, which are widely deployed by enterprises for secure remote access and privileged session management. An unauthenticated attacker can exploit this flaw to inject commands that execute as a site user, potentially achieving full system compromise. With a CVSS v3.1 base score of 9.8 and an EPSS score of 93.68% at the 99.8th percentile, this is one of the most severe and actively exploited remote access vulnerabilities. CISA has added CVE-2024-12356 to the Known Exploited Vulnerabilities catalog with an exceptionally tight remediation deadline of December 27, 2024, reflecting the critical nature and active exploitation of this flaw.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| beyondtrust | privileged remote access | <= 24.3.1 |
| beyondtrust | remote support | <= 24.3.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-12356(Third Party Advisory, US Government Resource)
- https://www.beyondtrust.com/trust-center/security-advisories/bt24-10(Vendor Advisory)
- https://www.cve.org/CVERecord?id=CVE-2024-12356(Third Party Advisory, US Government Resource)
- https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356(US Government Resource)
Weakness Type
Command Injection in Remote Access Platform
CVE-2024-12356 is a command injection vulnerability in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) products. Command injection occurs when an application passes unsanitized user-supplied data to a system shell or command interpreter, allowing attackers to append or inject arbitrary commands that execute on the underlying server. In this case, the vulnerability exists in a component accessible to unauthenticated users, enabling remote command execution without any prior authentication. The injected commands run with the privileges of the site user account under which the BeyondTrust application operates, which typically has significant system-level access given the privileged nature of the remote access platform.
Impact Analysis
The impact of CVE-2024-12356 is maximum across all dimensions of the CIA triad, each rated High. Confidentiality is fully compromised because command injection on a privileged remote access platform gives attackers access to session recordings, stored credentials, connection configurations, and any data managed by the BeyondTrust deployment. PRA and RS products are specifically designed to manage privileged access to critical infrastructure, meaning a compromise exposes the credentials and access paths to an organization's most sensitive systems.
Integrity faces catastrophic impact as command execution enables the attacker to modify application configurations, create backdoor accounts, alter audit logs, and manipulate the privileged access management infrastructure itself. An attacker who controls the privileged remote access platform can inject themselves into any managed session or modify access policies to grant persistent unauthorized access.
Availability is severely threatened because the attacker can disrupt or disable the remote access infrastructure, potentially locking out legitimate administrators and support personnel from all managed systems. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N). The EPSS score of 93.68% at the 99.8th percentile places this among the top 0.2% of all vulnerabilities in terms of exploitation probability. A Rapid7 analysis provides additional technical context on the exploitation mechanics. While CISA classifies the ransomware association as unknown, the ability to compromise a privileged access management platform makes this an ideal entry point for sophisticated attacks including ransomware deployment across managed endpoints.
Exploit Maturity
CVE-2024-12356 demonstrates the highest level of exploit maturity. CISA confirmed active exploitation and set an extraordinarily accelerated remediation deadline of December 27, 2024, just days after disclosure. The EPSS score of 93.68% at the 99.8th percentile indicates near-certain exploitation, placing it among the most exploited vulnerabilities in the entire CVE database.
Public exploit analysis is available through Rapid7's detailed writeup on AttackerKB, which provides technical breakdown of the vulnerability and exploitation methodology. The BeyondTrust security advisory confirms the severity and provides remediation guidance. The vulnerability's appeal to attackers is amplified by the nature of the target: BeyondTrust PRA and RS are privileged access management tools deployed by large enterprises and government agencies to secure remote access to their most critical infrastructure. Compromising this platform gives attackers a force-multiplying capability, effectively turning the organization's own privileged access tool into an attack platform. While CISA has not confirmed a direct ransomware connection, the tactical value of controlling privileged access infrastructure is immense for any attack objective, from espionage to ransomware deployment.
Remediation
-
Apply BeyondTrust patches immediately. Upgrade Privileged Remote Access (PRA) and Remote Support (RS) to versions newer than 24.3.1. The BeyondTrust security advisory BT24-10 provides specific version numbers and upgrade procedures. Given the critical severity and confirmed exploitation, this patch should be applied as an emergency change outside of normal maintenance windows.
-
Restrict network access to BeyondTrust instances. Immediately limit access to the BeyondTrust PRA and RS web interfaces to only authorized IP ranges. Implement firewall rules to block internet-facing access to the application, as the vulnerability is exploitable by unauthenticated attackers from the network.
-
Conduct thorough forensic analysis. Review BeyondTrust application logs, session recordings, and system audit trails for evidence of unauthorized command execution. Check for newly created accounts, modified configurations, unexpected outbound connections, and signs of credential harvesting from the privileged access management platform.
-
Rotate all managed credentials. Because BeyondTrust PRA manages privileged credentials for remote access sessions, any potential compromise means all stored and managed credentials should be rotated. This includes service account passwords, SSH keys, and any other authentication material stored within the BeyondTrust vault.
-
Review downstream systems for compromise indicators. Since BeyondTrust PRA and RS provide access to managed endpoints, examine all systems that were accessible through the platform for signs of unauthorized access or lateral movement. The privileged nature of the access paths means that downstream compromise could be extensive.
Technical Details
CVE-2024-12356 is a critical command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, representing the maximum practical severity for an unchanged-scope vulnerability: network-accessible, low complexity, no authentication or user interaction required, with high impact across all CIA dimensions.
The vulnerability exists in a web-accessible component of the BeyondTrust PRA and RS platform that fails to properly sanitize user input before incorporating it into system commands. An unauthenticated attacker can craft malicious requests to this component, injecting arbitrary commands that are then executed by the operating system with the privileges of the site user account. The site user typically runs with elevated permissions necessary for the remote access platform to manage privileged sessions, broker connections, and interact with the underlying operating system.
The attack surface is significant because BeyondTrust PRA and RS deployments are, by design, network-accessible to support remote access use cases. The affected component is reachable without authentication, meaning no credential brute-forcing or session hijacking is required. The attacker simply sends a crafted HTTP request containing injected commands to trigger arbitrary code execution.
Affected versions include all BeyondTrust Privileged Remote Access and Remote Support releases through version 24.3.1. The fix involves proper input validation and command parameterization to prevent user-supplied data from being interpreted as command syntax. Given the privileged nature of the application, successful exploitation provides attackers with a powerful foothold for accessing all systems and credentials managed through the BeyondTrust platform.
Frequently Asked Questions
What is CVE-2024-12356?
CVE-2024-12356 is a critical command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products. It allows unauthenticated attackers to inject and execute arbitrary commands on the host system, potentially compromising the entire privileged access management infrastructure.
How critical is CVE-2024-12356?
This is one of the most critical vulnerabilities in the CVE database, with a CVSS score of 9.8 and an EPSS score of 93.68% at the 99.8th percentile. CISA set an emergency remediation deadline of December 27, 2024, and active exploitation has been confirmed.
Which BeyondTrust products are affected?
Both Privileged Remote Access (PRA) and Remote Support (RS) versions 24.3.1 and earlier are vulnerable. Organizations should upgrade both products immediately using the guidance in BeyondTrust advisory BT24-10.
Why is this vulnerability especially dangerous?
BeyondTrust PRA and RS manage privileged access to an organization's most critical systems. Compromising this platform gives attackers access to stored credentials, session recordings, and the ability to connect to any managed endpoint with privileged access, making it an ideal pivot point for deep network intrusion.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.