CVE-2024-50590

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”. Path: C:\Elefant1\Firebird_2\bin\fbserver.exe Path: C:\Elefant1\Firebird_2\bin\fbguard.exe Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://hasomed.de/produkte/elefant/
https://r.sec-consult.com/hasomed

Configurations

No configuration.

History

No history.

Information

Published : 2024-11-08 12:15

Updated : 2024-11-08 19:01

NVD link : CVE-2024-50590

Mitre link : CVE-2024-50590

CVE.ORG link : CVE-2024-50590

JSON object : View

Products Affected

No product.

CWE

CWE-250

Execution with Unnecessary Privileges

CWE-276

Incorrect Default Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2024-50590", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-11-08T12:15:14.820", "references": [{"url": "https://hasomed.de/produkte/elefant/", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/hasomed", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-250"}, {"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Attackers with local access to the medical office computer can \nescalate their Windows user privileges to \"NT AUTHORITY\\SYSTEM\" by \noverwriting one of two Elefant service binaries with weak permissions.\u00a0The default installation directory of Elefant is \"C:\\Elefant1\" which is \nwritable for all users. In addition, the Elefant installer registers two\n Firebird database services which are running as \u201cNT AUTHORITY\\SYSTEM\u201d.\u00a0\n\nPath: C:\\Elefant1\\Firebird_2\\bin\\fbserver.exe\n\nPath: C:\\Elefant1\\Firebird_2\\bin\\fbguard.exe\n\n\nBoth service binaries are user writable. This means that a local \nattacker can rename one of the service binaries, replace the service \nexecutable with a new executable, and then restart the system. Once the \nsystem has rebooted, the new service binary is executed as \"NT \nAUTHORITY\\SYSTEM\"."}, {"lang": "es", "value": "Los atacantes con acceso local al equipo del consultorio m\u00e9dico pueden escalar sus privilegios de usuario de Windows a \"NT AUTHORITY\\SYSTEM\" sobrescribiendo uno de los dos binarios de servicio de Elefant con permisos d\u00e9biles. El directorio de instalaci\u00f3n predeterminado de Elefant es \"C:\\Elefant1\", que es escribible para todos los usuarios. Adem\u00e1s, el instalador de Elefant registra dos servicios de base de datos de Firebird que se ejecutan como \"NT AUTHORITY\\SYSTEM\". Ruta: C:\\Elefant1\\Firebird_2\\bin\\fbserver.exe Ruta: C:\\Elefant1\\Firebird_2\\bin\\fbguard.exe Ambos binarios de servicio son escribibles por el usuario. Esto significa que un atacante local puede cambiar el nombre de uno de los binarios de servicio, reemplazar el ejecutable de servicio con un nuevo ejecutable y luego reiniciar el sistema. Una vez que el sistema se ha reiniciado, el nuevo binario de servicio se ejecuta como \"NT AUTHORITY\\SYSTEM\"."}], "lastModified": "2024-11-08T19:01:03.880", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}