CVE-2024-50590
Local Privilege Escalation via Weak Service Binary Permissions
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Local Privilege Escalation via Weak Service Binary Permissions
Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”. Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".
Reserved 2024-10-25 | Published 2024-11-08 | Updated 2024-11-08 | Assigner SEC-VLabCWE-276 Incorrect Default Permissions
CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-250 Execution with Unnecessary Privileges
Tobias Niemann, SEC Consult Vulnerability Lab
Daniel Hirschberger, SEC Consult Vulnerability Lab
Florian Stuhlmann, SEC Consult Vulnerability Lab
r.sec-consult.com/hasomed
hasomed.de/produkte/elefant/
Support options
