CVE-2024-6592 WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
An attacker with network access can forge communications to retrieve or modify authenticated user and group information in WatchGuard SSO components.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6592?
CVE-2024-6592 is a critical missing authorization vulnerability in WatchGuard SSO Agent, published on 25 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components.
In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.
Which versions are affected by CVE-2024-6592?
It affects 2 products.
Products include Watchguard Authentication Gateway, Watchguard Single Sign-on Client.
How do I fix CVE-2024-6592?
No fix has been published for CVE-2024-6592 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6592 being exploited?
There is no known exploitation of CVE-2024-6592 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in WatchGuard SSO Agent
Sources
Also known as GHSA-fgxf-657w-ggqj.