Okta Urges Users to Check For Malicious Access After Security Fix

A recently disclosed vulnerability in Okta Classic configurations allowed attackers with valid credentials to bypass specific sign-on policies for certain applications. This flaw, which was introduced on July 17, 2024, potentially exposed sensitive applications to unauthorized access by circumventing policies like network zones, device-type restrictions, and custom authentication requirements.

Although Okta patched the vulnerability in their production environment on October 4, 2024, users are advised to check for any suspicious activity that may have occurred between July and October.

The vulnerability affected Okta Classic users, which is Okta's service for managing access to multiple applications securely. The exploit required specific conditions:

1. The attacker needed a valid username and password.
2. The organization had to use application-specific sign-on policies.
3. The attacker had to utilize a device type categorized as “unknown” by Okta (such as a Python script or an uncommon browser).

The critical nature of this flaw stems from its ability to let an attacker bypass application-specific security rules, potentially allowing unauthorized access to applications associated with the compromised policies. This risk extends to sensitive applications, including those with default rules like Microsoft Office 365 and Radius, which might not be user-configurable. Since valid credentials were a requirement, the vulnerability could be particularly dangerous if an attacker already possessed stolen or phished user credentials.

Okta quickly responded to this issue. Upon discovering the vulnerability on September 27, they activated their Product Security Incident Response Team (PSIRT) and worked to develop a patch, which was deployed by October 4, effectively resolving the vulnerability. However, the possibility of previous unauthorized access remains, and Okta users are recommended to investigate for any unusual activities during the window of exposure.

Recommendations for Okta users

Even though Okta has fixed the vulnerability, organizations that were on Okta Classic as of July 17, 2024, should proactively review their Okta System Logs for any signs of unauthorized access. The recommended search query is to look for successful authentications made using user agents marked as “Unknown” in Okta's logs between July 17 and October 4. This may help identify any potential exploitations during the exposure window.

Further investigation steps include:

• Searching for prior activities before July 17 to identify whether similar access attempts were made by the same “unknown” user-agent, which would indicate legitimate use.
• Reviewing failed authentication attempts that could point to credential-based attacks (e.g., credential stuffing or password spraying) shortly before any successful access.
• Checking for anomalies in user behavior, such as access from unusual IPs, geolocations, times of day, or Autonomous System Numbers (ASNs).

While the vulnerability required valid credentials to exploit, its criticality lies in its ability to bypass configured application-level security rules, allowing access beyond what was intended. Therefore, organizations should not be complacent even if Okta has already patched the flaw, as retrospective analysis is crucial for ensuring that no unauthorized access occurred during the vulnerability window.

Timeline of events

• July 17, 2024: The vulnerability was inadvertently introduced in a standard Okta release.
• September 27, 2024: Okta identified the issue, and their PSIRT team was activated to address it.
• September 27 – October 3, 2024: Patches were developed and rigorously tested.
• October 4, 2024: Patches were deployed to all affected products in production and preview environments, resolving the vulnerability.