CVE-2024-12356 — A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote…¶

Key facts

CVE-2024-12356 is a Critical (9.8) vulnerability: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-19), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2024-12356 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-19), confirming exploitation in the wild. Federal remediation deadline: 2024-12-27. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2024-12356
Severity	Critical (9.8)
CISA KEV	Actively exploited (added 2024-12-19)
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-12356/

Details¶

CVE-2024-12356 is a Critical (9.8) vulnerability: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

English | 한국어

Description¶

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Vulnerability Details¶

Property	Value
CVE ID	CVE-2024-12356
Type	COMMAND_INJECTION
CVSS Score	9.8

Proof of Concept¶

Download¶

# Download PoC script
curl -O https://raw.githubusercontent.com/fankh/vulnerability-poc/main/2024/CVE-2024-12356/poc.py

Usage¶

# Run PoC against target
python3 poc.py --target <TARGET_URL>

# With authentication
python3 poc.py --target <TARGET_URL> --username <USER> --password <PASS>

⚠️ Warning: This PoC is for authorized security testing only. It uses detection-only techniques and does not exploit or damage target systems.

Test Lab¶

This repository includes a Docker-based test environment with both vulnerable and patched applications.

Quick Start¶

# Clone and navigate to CVE directory
cd CVE-2024-12356

# Start both applications
docker-compose up -d

# Run tests
./run-tests.sh    # Linux/Mac
./run-tests.ps1   # Windows PowerShell

Application Endpoints¶

Application	URL	Status
Vulnerable App	http://localhost:8080	Shows vulnerability
Patched App	http://localhost:8081	Demonstrates fix

Directory Structure¶

├── README.md           # English documentation
├── README_KO.md        # Korean documentation
├── poc.py              # PoC detection script
├── docker-compose.yml  # Container orchestration
├── run-tests.sh        # Linux/Mac test runner
├── run-tests.ps1       # Windows test runner
├── vulnerable-app/     # Vulnerable version
│   ├── app.py
│   ├── Dockerfile
│   └── requirements.txt
└── patched-app/        # Fixed version
    ├── app.py
    ├── Dockerfile
    └── requirements.txt

References¶

https://nvd.nist.gov/vuln/detail/CVE-2024-12356
https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
https://www.cve.org/CVERecord?id=CVE-2024-12356
https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356

Generated by PoC Generator on 2026-01-03T13:36:08.553530847

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2024-12356, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2024-12356 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-12356 - Snort IDS Rules
# Severity: High

# Detect potential exploit attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-12356 Potential Exploit Attempt";
    flow:to_server,established;
    content:".."; http_uri;
    classtype:web-application-attack;
    sid:2024123561;
    rev:1;
    metadata:cve CVE-2024-12356, severity high;
)

# Detect suspicious patterns in request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-12356 Suspicious Request Pattern";
    flow:to_server,established;
    pcre:"/(%2e%2e|%252e|\x00)/Ui";
    classtype:web-application-attack;
    sid:2024123562;
    rev:1;
    metadata:cve CVE-2024-12356, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-12356 - YARA Detection Rules
 */

rule CVE_2024_12356_Exploit {
    meta:
        description = "Detects potential CVE-2024-12356 exploit attempts"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2024-12356"

    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\" ascii wide
        $encoded1 = "%2e%2e" ascii wide nocase
        $encoded2 = "%252e" ascii wide nocase
        $null_byte = "%00" ascii wide

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2024-12356 - Prevention Rules for Nginx

# Block common exploit patterns
location / {
    # Rate limiting
    limit_req zone=general burst=20 nodelay;

    # Block suspicious patterns
    if ($request_uri ~* "(\.\.[\/]|%2e%2e|%252e)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Log suspicious activity
access_log /var/log/nginx/CVE-2024-12356-access.log;
error_log /var/log/nginx/CVE-2024-12356-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2024-12356 - Prevention Rules for Apache httpd

# Block common exploit patterns
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block path traversal
    RewriteCond %{REQUEST_URI} (\.\.[\/]|%2e%2e|%252e) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2024-12356-access.log combined
ErrorLog /var/log/httpd/CVE-2024-12356-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2024-12356?¶

CVE-2024-12356 is a Critical (9.8) vulnerability: A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote…. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2024-12-19), confirming active exploitation in the wild.

How do I detect CVE-2024-12356?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2024-12356?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2024-12356 actively exploited?¶

Yes. CVE-2024-12356 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2024-12-19, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2024-12-27. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.