Authorization vulnerability in PAM360

Vulnerability

An authorization vulnerability exists in Zohocorp ManageEngine PAM360 version 6600. The internal security team discovered that the product fails to properly enforce access controls, allowing a low-privileged user to perform administrative actions. The issue affects only builds installed or upgraded to version 6600 on or before 10 April 2024 [1].

Exploitation

An attacker with a low-privileged account can exploit this vulnerability by sending specially crafted requests to the PAM360 server. No additional authentication or network position beyond existing user access is required; the flaw lies in the software's authorization logic [1].

Impact

Successful exploitation enables a non-admin user to execute privileged operations, effectively granting the attacker administrative control over the PAM360 instance. This can lead to full compromise of the privileged access management solution, including disclosure or manipulation of sensitive credentials and configurations [1].

Mitigation

Zohocorp released PAM360 version 6601 on 10 April 2024, which fixes the authorization vulnerability. Customers running version 6600 are strongly advised to upgrade to the latest build immediately. Upgrade packs are available from the product's update page [1]. No workarounds are documented.