N-able N-central < 2024.2 - Authentication Bypass Detection

criticalseverity

9.1CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

N-central server versions prior to 2024.2 contain an authentication bypass in the user interface, letting attackers access restricted areas without proper credentials, exploit requires no specific conditions.

Impact

Attackers can access sensitive user interface features, potentially leading to unauthorized data access or control.

Fix

Update to version 2024.2 or later.

How to confirm it

Send: GET {{BaseURL}}/login
Positive when: contains "class=\"ncentral\"" AND compare_versions(version, '< 2024.2')

Run it with nuclei: nuclei -id CVE-2024-28200 -u <target>

The full check

id: CVE-2024-28200

info:
  name: N-able N-central < 2024.2 - Authentication Bypass Detection
  author: rxerium
  severity: critical
  description: |
    N-central server versions prior to 2024.2 contain an authentication bypass in the user interface, letting attackers access restricted areas without proper credentials, exploit requires no specific conditions.
  impact: |
    Attackers can access sensitive user interface features, potentially leading to unauthorized data access or control.
  remediation: |
    Update to version 2024.2 or later.
  reference:
    - https://status.n-able.com/2024/07/02/n-central-critical-security-fix-details/
    - https://me.n-able.com/s/security-advisory/aArVy0000000673KAA/cve202428200-ncentral-authentication-bypass
    - https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-28200
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28200
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-28200
    cwe-id: CWE-287
    epss-score: 0.01946
    epss-percentile: 0.80352
    cpe: cpe:2.3:a:n-able:n-central:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: N-able
    product: N-central
    shodan-query: http.title:"N-central Login"
  tags: cve,cve2024,n-able,ncentral,passive,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/login"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'class="ncentral"'

      - type: dsl
        dsl:
          - compare_versions(version, '< 2024.2')

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - 'ncentralVersion:\s*"(202\d+\.\d+\.\d+\.\d+)"'

References

Use this check only on systems you are authorised to test. Where the data comes from