Conexiones locales directas al MS Agents pueden omitir la autenticación

Successful exploitation of CVE-2024-7345 could grant an attacker unauthorized access and control over the affected OpenEdge system. By injecting malicious code into Multi-Session Agents, an attacker could potentially execute arbitrary commands, steal sensitive data, or even gain persistent access to the system. The impact is particularly concerning in environments where Multi-Session Agents are used to manage critical business processes, as a compromised agent could disrupt operations or lead to data breaches. The blast radius extends to any data processed or managed by the compromised agents.

Organizations heavily reliant on OpenEdge for critical business operations, particularly those utilizing Multi-Session Agents for data processing and management, are at significant risk. Legacy OpenEdge deployments running versions prior to 12.8.1 are especially vulnerable. Shared hosting environments where multiple users share OpenEdge resources also face increased exposure.

• windows / other: Monitor OpenEdge logs for unusual ABL client activity, specifically focusing on attempts to execute unauthorized code. Use Sysinternals tools like Process Monitor to track process creation and network connections related to Multi-Session Agents. • linux / server: Examine OpenEdge audit logs for suspicious ABL client connections or code execution attempts. Use lsof to identify processes accessing Multi-Session Agent resources. • generic web: While not directly web-facing, monitor network traffic to and from OpenEdge servers for unusual patterns or connections originating from ABL clients.

1. 2024-09-03Disclosure

   disclosure

1. Reservado2024-07-31
2. Publicada2024-09-03
3. EPSS actualizado2026-04-02

The primary mitigation for CVE-2024-7345 is to upgrade to OpenEdge version 12.8.1 or later, which includes the necessary security fixes. If immediate upgrading is not feasible, consider implementing stricter access controls and monitoring Multi-Session Agent activity for suspicious behavior. Review and restrict permissions granted to ABL clients to minimize the potential impact of a successful injection. While a direct workaround is not available, implementing robust logging and auditing of ABL client interactions can aid in detection and incident response. After upgrading, confirm the fix by attempting to trigger the vulnerability and verifying that the security checks are now enforced.