Advisory Details

May 22nd, 2024

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

ZDI-24-491
ZDI-CAN-23035

CVE ID CVE-2024-4454
CVSS SCORE 7.3, AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AFFECTED VENDORS WithSecure
AFFECTED PRODUCTS Elements
VULNERABILITY DETAILS

This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability.

The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

ADDITIONAL DETAILS WithSecure has issued an update to correct this vulnerability. More details can be found at:
https://www.withsecure.com/en/support/security-advisories/cve-2024-4454
DISCLOSURE TIMELINE
  • 2024-02-23 - Vulnerability reported to vendor
  • 2024-05-22 - Coordinated public release of advisory
CREDIT Nicholas Zubrisky (@NZubrisky) and Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative
BACK TO ADVISORIES