CVE-2021-45492

{"id": "CVE-2021-45492", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-07-14T16:15:08.230", "references": [{"url": "https://controlgap.com/blog?tag=insecurity", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.controlgap.com/blog/sage-300-case-study", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://controlgap.com/blog?tag=insecurity", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.controlgap.com/blog/sage-300-case-study", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\\Sage\\Sage300\\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C:\\ folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory. Note that while older versions of the software default to installing in %PROGRAMFILES(X86)% (which would allow the Sage folder to inherit strong permissions, making the installation not vulnerable), the official Sage 300 installation guides for those versions recommend installing in C:\\Sage, which would make the installation vulnerable."}, {"lang": "es", "value": "En Sage 300 ERP (anteriormente accpac) versiones hasta 6.8.x, el instalador configura el directorio C:\\Sage\\Sage300\\Runtime para que sea la primera entrada en la variable de entorno PATH del sistema. Sin embargo, este directorio puede ser escrito por usuarios no privilegiados porque el instalador de Sage no establece permisos expl\u00edcitos y, por lo tanto, hereda los permisos d\u00e9biles de la carpeta C:\\N. Debido a que las entradas en la variable PATH de todo el sistema son incluidas en el orden de b\u00fasqueda de DLLs, un atacante podr\u00eda llevar a cabo el secuestro del orden de b\u00fasqueda de DLLs para escalar sus privilegios a SYSTEM. Adem\u00e1s, si la funcionalidad de B\u00fasqueda Global o Pantallas Web est\u00e1 habilitada, entonces es posible una escalada de privilegios por medio de los servicios GlobalSearchService y Sage.CNA.WindowsService, de nuevo por medio del secuestro del orden de b\u00fasqueda de DLL porque los usuarios no privilegiados tendr\u00edan permisos de modificaci\u00f3n en el directorio de la aplicaci\u00f3n. Tenga en cuenta que mientras las versiones m\u00e1s antiguas del software son instaladas por defecto en %PROGRAMFILES(X86)% (lo que permitir\u00eda que la carpeta Sage heredara permisos fuertes, haciendo que la instalaci\u00f3n no fuera vulnerable), las gu\u00edas oficiales de instalaci\u00f3n de Sage 300 para esas versiones recomiendan instalar en C:\\NSage, lo que har\u00eda que la instalaci\u00f3n fuera vulnerable"}], "lastModified": "2024-11-21T06:32:19.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8A63515-64F4-4132-B748-C4759CBA67FD", "versionEndIncluding": "2022"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}