Skip to content

Instantly share code, notes, and snippets.

@Hagrid29

Hagrid29/CVE-2024-22795.md

Created February 7, 2024 20:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Hagrid29/aea0dc35a1e87813dbbb7b317853d023 to your computer and use it in GitHub Desktop.
Save Hagrid29/aea0dc35a1e87813dbbb7b317853d023 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2024-22795
Raw
CVE-2024-22795.md

CVE-2024-22795 (Arbitrary File Delete that Leads to Privilege Escalation on Forescout SecureConnector)

Product

Forescout SecureConnector

Version

11.3.06.0063

Vulnerable Component

SecureConnector.exe

Description

On Windows system, it was found that ForeScout SecureConnector (version 11.3.06.0063) perform privileged operation, such as creating, executing and deleting files, within a folder owned by an unprivileged user.

Impact

A malicious user is able to achieve privilege escalation by winning race condition to modify a script file that will be executed by SecureConnector; or by exploiting arbitrary file delete with symbolic link attack.

Resolution

This vulnerability is patched since Forescout SecureConnector 11.3.7.

Disclosure Timeline

  • 10/30/2023 - Vulnerability reported to Forescout
  • 11/30/2023 - ForeScout confirmed that it was an issue reported by another pentester two months ago and has been remediated in latest release (version 11.3.7)

Reference

https://github.com/Hagrid29/ForeScout-SecureConnector-EoP

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22795

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment