Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in Secret Server on-prem that allows an attacker to bypass authentication and gain access to accounts by exploiting a two-factor authentication flaw.
- Bypass authentication for any account.
- Protects sensitive privileged access.
- Confirm relevance and exposure to sensitive data.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit a flaw in Delinea Secret Server to bypass initial authentication steps and directly authenticate using only a two-factor PIN. This could lead to unauthorized access to sensitive information managed by the compromised account.
- No prior authentication required.
- Triggered by generating a two-factor PIN.
- Risk of unauthorized account access.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, a user could bypass authentication to generate a two-factor PIN for any account and then use that PIN to log in. This could potentially expose sensitive information managed by the Secret Server.
- System data and user credentials at risk.
- Bypass initial login, authenticate with second factor.
- Unauthorized access to sensitive information.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in on-prem Secret Server impacts authentication mechanisms. The first step is to identify all instances, assess their reachability and business criticality, and then locate the accountable owners to plan a risk-based remediation.
- Issue ownership by platform or security teams.
- Verify external or internal reachability.
- Plan remediation based on asset criticality.
