“ALL YOUR SECRETS ARE BELONG TO US” - A DELINEA SECRET SERVER AUTHN/AUTHZ BYPASS

Summary from the TLDR InfoSec newsletter

Delinea Secret Server is a PAM that helps organizations secure, manage, and monitor privileged accounts. This post delves through the process of hunting for an AuthN/AuthZ bypass, decompiling the relevant code sections, and crafting the exploit. It includes detailed reproduction steps and a proof of concept for obtaining admin access.