CVE-2021-37363

An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.

CVSS v3 7.8 HIGH
CVSS v2.0 9.3 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.exploit-db.com/exploits/50449	Exploit Third Party Advisory VDB Entry
https://www.gestionaleopen.org/	Product
https://www.exploit-db.com/exploits/50449	Exploit Third Party Advisory VDB Entry
https://www.gestionaleopen.org/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:gestionaleopen:gestionale_open:11.00.00:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-10-26 14:15

Updated : 2024-11-21 06:15

NVD link : CVE-2021-37363

Mitre link : CVE-2021-37363

CVE.ORG link : CVE-2021-37363

JSON object : View

Products Affected

gestionaleopen

gestionale_open

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2021-37363", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-10-26T14:15:07.567", "references": [{"url": "https://www.exploit-db.com/exploits/50449", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.gestionaleopen.org/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/50449", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.gestionaleopen.org/", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in bin folder and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues."}, {"lang": "es", "value": "Se presenta un problema de permisos no seguros en Gestionale Open versi\u00f3n 11.00.00. Una cuenta poco privilegiado es capaz de renombrar el archivo mysqld.exe ubicado en la carpeta bin y sustituirlo por un archivo malicioso que se conectar\u00eda de nuevo a un ordenador atacante d\u00e1ndole privilegios a nivel de sistema (nt authoritysystem) debido a que el servicio es ejecutado como Sistema Local. Mientras que un usuario poco privilegiado no puede reiniciar el servicio mediante la aplicaci\u00f3n, un reinicio del ordenador desencadena una ejecuci\u00f3n del archivo malicioso. La aplicaci\u00f3n tambi\u00e9n presenta problemas de ruta de servicio no citada"}], "lastModified": "2024-11-21T06:15:00.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gestionaleopen:gestionale_open:11.00.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "33570280-5D8F-4128-9B3E-1025CE51A33E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}