Unauthenticated RCE in BeyondTrust PRA and RS

CVE-2024-12356 is a critical vulnerability affecting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS), affecting versions up to and including 24.3.1. Public vendor and third-party reporting initially described the issue as an unauthenticated command injection that allows a remote attacker to send a malicious client request and execute commands as the site user. Subsequent Rapid7 analysis indicates the vulnerable RS exploitation path is more precisely characterized as argument injection in the thin-scc-wrapper code path reachable via the /nw WebSocket endpoint. In the analyzed path, attacker-controlled input is passed via an unquoted gskey variable into shell processing, enabling injection of echo arguments such as -e to emit raw bytes. That data is then processed by a dbquote helper and ultimately consumed by PostgreSQL psql. Rapid7 concluded that tested RCE exploitation paths for RS required chaining with PostgreSQL flaw CVE-2025-1094, because invalid UTF-8 byte sequences could survive escaping and be interpreted by psql in a way that enabled SQL injection and then OS command execution via psql meta-commands such as !. BeyondTrust nevertheless patched the product-side issue by adding input validation that blocks the malicious gskey values needed for exploitation.