CVE-2021-41065

An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically access the named pipe and the attacker will be able to duplicate the victim's token to impersonate him. This exploit is valid in certain Windows versions (Microsoft has patched the issue in later Windows 10 builds).

CVSS v3 7.3 HIGH
CVSS v2.0 4.4 MEDIUM

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e
https://www.listary.com/download	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bopsoft:listary:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:38

Type	Values Removed	Values Added
References	{'url': 'https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e', 'name': 'https://medium.com/@tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': 'MISC'}	() https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e -

Information

Published : 2021-12-14 16:15

Updated : 2024-02-28 18:48

NVD link : CVE-2021-41065

Mitre link : CVE-2021-41065

CVE.ORG link : CVE-2021-41065

JSON object : View

Products Affected

bopsoft

listary

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2021-41065", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2021-12-14T16:15:09.020", "references": [{"url": "https://medium.com/%40tomerp_77017/exploiting-listary-searching-your-way-to-system-privileges-8175af676c3e", "source": "cve@mitre.org"}, {"url": "https://www.listary.com/download", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Listary through 6. An attacker can create a \\\\.\\pipe\\Listary.listaryService named pipe and wait for a privileged user to open a session on the Listary installed host. Listary will automatically access the named pipe and the attacker will be able to duplicate the victim's token to impersonate him. This exploit is valid in certain Windows versions (Microsoft has patched the issue in later Windows 10 builds)."}, {"lang": "es", "value": "Se ha detectado un problema en Listary versiones hasta 6. Un atacante puede crear una tuber\u00eda con nombre \\\\NListary.listaryService y esperar a que un usuario con privilegios abra una sesi\u00f3n en el host instalado de Listary. Listary acceder\u00e1 autom\u00e1ticamente a la tuber\u00eda con nombre y el atacante podr\u00e1 duplicar el token de la v\u00edctima para hacerse pasar por ella. Esta explotaci\u00f3n es v\u00e1lida en determinadas versiones de Windows (Microsoft ha parcheado el problema en builds posteriores de Windows 10)"}], "lastModified": "2023-11-07T03:38:48.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bopsoft:listary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDA504B6-1CF2-4E5C-B146-8D73812F47F2", "versionEndIncluding": "6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}