The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
Metrics
Affected Vendors & Products
References
History
Thu, 12 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Netskope
Published: 2023-06-15T06:44:25.434Z
Updated: 2024-12-12T17:05:07.261Z
Reserved: 2022-11-28T12:19:11.243Z
Link: CVE-2022-4149
Vulnrichment
Updated: 2024-08-03T01:27:54.588Z
NVD
Status : Modified
Published: 2023-06-15T07:15:08.710
Modified: 2024-11-21T07:34:40.340
Link: CVE-2022-4149
Redhat
No data.