CVE-2024-12356: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2024-12356 is a command injection vulnerability in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS). An unauthenticated attacker can inject commands that execute as a site user. Because these products manage privileged remote access, successful abuse can give an outsider a foothold on systems that control sensitive administrative sessions. Confirm all product-specific details against the vendor advisory.

CISA notes that organizations should apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Ransomware use of this CVE is not documented.

How it works

The flaw is classified as CWE-77 (command injection). In products of this class, user-supplied input reaches a shell or command interpreter without sufficient sanitization. An attacker who can reach the vulnerable interface can craft input that the application treats as part of an operating-system command. Because the CVE summary states the injected commands run as a site user and no authentication is required, the attacker does not need prior credentials. Exact injection points, request formats, and payload construction are not provided in the public summary; treat any technical reproduction details as unconfirmed until verified against the vendor advisory.

Am I affected? How to find it in your systems

BeyondTrust PRA and RS are typically deployed as appliances or virtual appliances that broker privileged remote sessions for IT and support staff. They often sit at the network edge or in a DMZ so that external technicians can reach internal systems under controlled conditions.

• Inventory all instances of BeyondTrust Privileged Remote Access and Remote Support by querying asset-management databases, network-discovery tools, and configuration-management databases for the product names or related hostnames.
• Check the version and build of every discovered instance against the fixed versions listed in the vendor advisory; public detail on exact affected releases is limited, so rely solely on the advisory.
• Review configuration for any externally reachable management or support portals; unauthenticated access paths are the primary concern given the CVE description.
• Examine application and system logs for unexpected command execution, anomalous process spawning under the site-user context, or unusual inbound requests to the product’s web or API endpoints. Telemetry that shows shell activity originating from the BeyondTrust service account should be treated as suspicious until investigated.

How to remediate

Patch first. Apply the vendor-supplied update that addresses CVE-2024-12356 as soon as it is available and tested in your environment. Confirm the exact package name, version, and installation procedure against the official BeyondTrust advisory.

• After patching, restart the affected services and verify that the new version is running.
• For this class of command-injection weakness, ensure that any remaining input-validation or output-encoding controls recommended by the vendor are enabled.
• Restrict the privileges of the site user under which the product runs so that even successful injection has limited impact.
• If the product is no longer required, follow CISA guidance and discontinue its use.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls.

• Segment the PRA/RS hosts so that only authorized management networks can reach their interfaces; block all unauthenticated internet access if possible.
• Place a web application firewall or reverse-proxy rule set in front of the product to filter known command-injection patterns; treat this as virtual patching and tune it carefully to avoid breaking legitimate support workflows.
• Disable any non-essential remote-support features or public portals that are not required for business operations.
• Increase monitoring: alert on process creation, shell invocations, and outbound connections originating from the BeyondTrust service accounts. Retain logs for forensic review.

If your data may have been exposed

Actively exploited command-injection flaws can lead to unauthorized access and subsequent data exposure. If you have evidence that an unauthenticated attacker reached a vulnerable PRA or RS instance, treat the environment as potentially compromised: rotate credentials used by the product, review session logs for unauthorized privileged activity, and follow your incident-response plan. You can also run a free exposure scan of your email addresses to check whether those addresses appear in known breach data sets.