CVE-2024-7401 Client Enrollment Process Bypass

What is CVE-2024-7401?

CVE-2024-7401 is a high-severity authentication bypass vulnerability in Netskope Client, published on 26 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.

Weakness: CWE-287

Which versions are affected by CVE-2024-7401?

It affects 1 product.

Products include Netskope Netskope.

How do I fix CVE-2024-7401?

No fix has been published for CVE-2024-7401 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-7401 being exploited?

There is no known exploitation of CVE-2024-7401 in the wild and no public exploit code.

Other vulnerabilities in Netskope Client

• CVE-2020-24576 Privilege escalation in n/a High 8.8
• CVE-2021-44862 Sensitive Information store in NSClient logs High 8.4
• CVE-2021-41388 Privilege escalation in n/a High 7.8
• CVE-2020-28845 Code injection in n/a High 7.8
• CVE-2019-12091 Netskope client command injections vulnerability High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rcmr-c4gr-768m.