A high-severity vulnerability in Dynatrace OneAgent allows unprivileged local attackers to perform NTLM relay attacks by exploiting improper handling of network share authentication failures.

The vulnerability exists due to incorrect error handling when the agent encounters a STATUS_LOGON_FAILURE while accessing a remote network share. This triggers the agent to retrieve and iterate through all available user tokens on the host to attempt repeated authentication, enabling an unauthenticated attacker to facilitate NTLM relay attacks.

The ability for an unprivileged attacker to perform NTLM relay attacks poses a significant risk to internal network security, potentially leading to unauthorized lateral movement and privilege escalation within the domain. With a CVSS score of 7.5, this flaw represents a high risk to the confidentiality and integrity of sensitive enterprise authentication data. Failure to address this could facilitate full system compromise if NTLM relaying leads to domain controller access or sensitive credential harvesting.

Immediate Action: Update all instances of Dynatrace OneAgent to version 1.325.47 or later to remediate the vulnerable token handling logic.

Proactive Monitoring: Monitor network traffic for suspicious NTLM authentication patterns or unexpected SMB requests originating from hosts running OneAgent.

Compensating Controls: Implement SMB signing and LDAP channel binding to mitigate the impact of NTLM relay attacks while the update is being deployed across the environment.

Public Exploit Available: Unknown

Given the potential for lateral movement and the ease with which this vulnerability can be triggered, organizations should prioritize patching Dynatrace OneAgent immediately. Administrators must ensure that the update to version 1.325.47 is applied across all endpoints to prevent unauthorized token impersonation and NTLM relay-based attacks.