CVE-2022-4149: Local privilege escalation using log file
First published: Thu Jun 15 2023(Updated: )
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
Credit: psirt@netskope.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netskope | <100 | |
| Microsoft Windows Operating System |
Remedy
Netskope has patched the vulnerability and released a binary with a fix. Customers are recommended to upgrade their Netskope clients to v100 or later. Netskope download Instructions – Download Netskope Client and Scripts – Netskope Support https://support.netskope.com/s/article/Download-Netskope-Client-and-Scripts
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-4149?
CVE-2022-4149 is a vulnerability in the Netskope client service on Windows, allowing a standard user to write log files to a writable directory.
How does CVE-2022-4149 affect Windows?
CVE-2022-4149 affects the Netskope client service running on Windows, specifically versions prior to R96.
What is the severity of CVE-2022-4149?
CVE-2022-4149 has a severity level of high with a severity value of 7.
How can CVE-2022-4149 be exploited?
CVE-2022-4149 can be exploited by a standard user who is able to create and write log files in the C:\Users\Public\netSkope directory.
Is there a fix for CVE-2022-4149?
Yes, updating the Netskope client service to version R96 or higher will fix CVE-2022-4149.
- agent/type
- agent/title
- agent/author
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/netskope
- canonical/netskope
- vendor/microsoft
- canonical/microsoft windows operating system