CVE-2024-14047: Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service
A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected Winlogbeat Windows installer are exposed when unprivileged local users can access the system and write to the installer-created runtime directory. Remote-only attackers are not described as able to exploit this issue.
What does an attacker need to exploit it?
An attacker needs existing low-privileged local access and must pre-position malicious filesystem links in the writable runtime directory. A subsequent elevated Winlogbeat operation must then access the linked path.
What impact can exploitation have?
The elevated operation can be induced to write to or delete arbitrary files. The described successful outcome is denial of service, and the vulnerability is also rated for high integrity and availability impact.