CVE-2024-12356

What it actually does

This is a critical unauthenticated command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). A remote attacker can send crafted input to the product that is interpreted as operating-system commands, causing those commands to execute in the security context of the site user. Successful exploitation can allow arbitrary command execution on the appliance/application host, potentially enabling persistence, credential access, lateral movement, data theft, or full compromise of the remote access platform.

Why it matters to the business

Because PRA and RS are used to administer and support sensitive systems, compromise can give an attacker a powerful foothold into privileged remote access workflows. The vulnerability is listed in CISA KEV, has a high EPSS probability, and is reported as actively exploited in the wild, so exposed instances should be treated as urgent. Organizations may face service disruption, unauthorized remote access, credential compromise, regulatory exposure, and downstream compromise of systems managed through the platform. The CISA remediation deadline was 2024-12-27, so any unremediated system is significantly overdue.

How an attack unfolds

An attacker first identifies an internet-accessible or otherwise reachable BeyondTrust PRA or RS instance. They then send a specially crafted unauthenticated request containing command-injection syntax. The vulnerable component passes attacker-controlled input to an operating-system command without proper neutralization, causing the injected command to run as the site user. Initial commands are commonly used to verify execution, enumerate the host, download tooling, create persistence, or stage a reverse shell. After gaining execution, the attacker may inspect application configuration, session data, logs, credentials, API keys, or integration secrets, then use the remote access platform’s trusted position to move further into managed environments. Active exploitation and KEV inclusion mean defenders should assume exploitation attempts may have occurred before patching, especially where the service was externally reachable.

How to fix it

Upgrade or patch BeyondTrust Privileged Remote Access and Remote Support according to the latest BeyondTrust security advisory for CVE-2024-12356. If using a vendor-hosted/SaaS deployment, confirm with the vendor that the instance has received the security update. If using an on-premises deployment, apply the vendor-provided fixed release or hotfix immediately; where exact package versions are not available from asset data, obtain the current fixed version directly from BeyondTrust support/advisories and do not rely on compensating controls alone. Until patched, restrict network access to the management and support interfaces, place the service behind VPN or trusted administrative networks only, block direct internet exposure, disable unnecessary integrations, rotate credentials and API tokens associated with the platform, and monitor for post-exploitation activity. After patching, review vendor guidance for any required credential rotation, integrity checks, or forensic collection.

How to confirm the fix worked

Confirm the installed PRA/RS version and patch level from the product administrative interface, appliance management console, or vendor-supported version command, and verify it matches a release identified by BeyondTrust as fixed for this vulnerability. Confirm there is no direct internet exposure unless explicitly required and protected by access controls. Review external attack-surface scans and firewall/load-balancer rules to ensure only trusted sources can reach the service. Validate that web requests containing shell metacharacters or command substitution are rejected or safely handled, using only authorized and controlled testing. Check that no unexpected outbound connections, new local accounts, modified startup tasks, suspicious files, or unusual child processes were created around the exposure window. If exploitation is suspected, perform incident response before simply restoring or upgrading the system.

Typical attack path

1. Scan for exposed BeyondTrust PRA or Remote Support interfaces.
2. Fingerprint the product and version or test for vulnerable behavior.
3. Send a crafted unauthenticated request containing shell metacharacters or command-substitution payloads.
4. Execute a low-noise command to confirm code execution, such as an identity, hostname, DNS, or outbound callback test.
5. Run follow-on commands to enumerate the appliance/application host and current user context.
6. Download or stage additional tooling using curl, wget, PowerShell, or similar utilities where available.
7. Attempt persistence, credential access, log tampering, or remote shell access.
8. Search for stored secrets, integration credentials, session artifacts, or privileged remote access data.
9. Use compromised access to pivot into systems managed through PRA or RS.

How to detect it

Investigate web access logs, reverse proxy logs, WAF logs, load-balancer logs, appliance/application logs, authentication and session logs, system process logs, EDR telemetry, DNS logs, and outbound firewall/proxy logs for activity targeting BeyondTrust PRA/RS during the exposure window. Look for unauthenticated requests containing shell metacharacters, command substitution, encoded payloads, newline injection, or attempts to invoke common utilities such as sh, bash, curl, wget, nc, python, perl, or PowerShell. Correlate suspicious requests with unexpected child processes spawned by the web/application service, outbound network callbacks, file writes in temporary directories, new users, modified startup locations, configuration exports, or unusual administrative changes. Review PRA/RS audit logs for unexpected support sessions, privileged access sessions, account creation, permission changes, API token activity, integration changes, or session recordings accessed outside normal patterns. Because this vulnerability is known to be actively exploited, absence of a blocked WAF event is not sufficient; perform host/appliance-level and network-level hunting where telemetry is available.

• ; id
• ; whoami
• ; uname -a
• ; cat /etc/passwd
• $(id)
• $(whoami)
• `id`
• `whoami`
• |/bin/sh
• | /bin/sh
• /bin/bash -c
• /bin/sh -c
• sh -c
• bash -c
• curl http
• curl -fsSL
• wget http
• wget -qO-
• python -c
• python3 -c
• perl -e
• php -r
• nc -e
• ncat -e
• bash -i
• /dev/tcp/
• base64 -d
• chmod +x /tmp/
• /tmp/.
• nohup
• setsid
• mkfifo /tmp/
• powershell -enc
• cmd.exe /c
• certutil -urlcache
• Invoke-WebRequest
• Unauthorized command injection attempt
• command injection
• shell metacharacter
• site user

What your security team should do

• Treat all externally reachable BeyondTrust PRA/RS instances as high priority because the vulnerability is KEV-listed, has active exploitation, and has a high EPSS score.
• Patch or upgrade immediately using BeyondTrust’s current fixed release or hotfix; the CISA KEV due date of 2024-12-27 has already passed.
• Identify all PRA/RS deployments, including on-premises appliances, cloud-hosted instances, disaster-recovery systems, test systems, and partner-managed deployments.
• Temporarily restrict access to trusted administrative networks or VPNs until remediation and validation are complete.
• Review logs for exploitation attempts and successful post-exploitation activity before and after patching.
• Rotate credentials, API keys, integration secrets, and privileged accounts that may be accessible through or stored by the platform if compromise cannot be ruled out.
• Hunt for command execution artifacts, suspicious outbound callbacks, webshell-like behavior, reverse shells, and unexpected files or processes on the appliance/application host.
• Verify no unauthorized remote sessions, support sessions, account changes, configuration exports, or privilege changes occurred.
• Engage BeyondTrust support or incident response specialists if appliance integrity is uncertain or if logs show command execution indicators.
• Add SIEM detections for command-injection patterns targeting PRA/RS web endpoints and for suspicious process/network activity originating from the platform.