Collected research
Delinea Protocol Handler - Remote Code Execution via Update Process (CVE-2024-12908)
The sslauncher:// URI handler takes an ssurl parameter and, with autoUpdateEnabled=true, fetches an update over SOAP from that host, extracts the returned zip and runs its setup.bat msiexec line. The MSI must be Delinea-signed, but arbitrary msiexec parameters are honoured, so a bundled .mst transform rewrites the signed installer at runtime and executes code. ToLower() folds a punycode dotted capital I to i, so the approval prompt is skipped.
Record
- Researcher
- David Cash and Richard Warren
- Published by
- blog.amberwolf.com
- Format
- Advisory
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of David Cash and Richard Warren, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .