CVE-2022-24139

In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://advanced.com	Not Applicable
http://iobit.com	Vendor Advisory
https://github.com/tomerpeled92/CVE/	Third Party Advisory
http://advanced.com	Not Applicable
http://iobit.com	Vendor Advisory
https://github.com/tomerpeled92/CVE/	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:iobit:advanced_system_care:15::::free:::
	cpe:2.3:a:iobit:advanced_system_care:15::::pro:::

History

21 Nov 2024, 06:49

Type	Values Removed	Values Added
References	~~() http://advanced.com - Not Applicable~~	() http://advanced.com - Not Applicable
References	~~() http://iobit.com - Vendor Advisory~~	() http://iobit.com - Vendor Advisory
References	~~() https://github.com/tomerpeled92/CVE/ - Third Party Advisory~~	() https://github.com/tomerpeled92/CVE/ - Third Party Advisory

Information

Published : 2022-07-06 13:15

Updated : 2024-11-21 06:49

NVD link : CVE-2022-24139

Mitre link : CVE-2022-24139

CVE.ORG link : CVE-2022-24139

JSON object : View

Products Affected

iobit

advanced_system_care

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2022-24139", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-07-06T13:15:09.273", "references": [{"url": "http://advanced.com", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "http://iobit.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/tomerpeled92/CVE/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://advanced.com", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://iobit.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/tomerpeled92/CVE/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used."}, {"lang": "es", "value": "En IOBit Advanced System Care (AscService.exe) versi\u00f3n 15, un atacante con SEImpersonatePrivilege puede crear una tuber\u00eda con nombre con el mismo nombre que una de las tuber\u00edas con nombre de ASCService. ASCService primero intenta conectarse antes de intentar crear las tuber\u00edas con nombre, debido a que durante el inicio de sesi\u00f3n el servicio intentar\u00e1 conectarse con el atacante lo que conllevar\u00e1 a una escalada de privilegios (mediante la manipulaci\u00f3n de tokens e ImpersonateNamedPipeClient() ) desde ADMIN -) SYSTEM o desde Local ADMIN-) Domain ADMIN dependiendo del usuario y la tuber\u00eda con nombre que sea usado"}], "lastModified": "2024-11-21T06:49:53.287", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:iobit:advanced_system_care:15:*:*:*:free:*:*:*", "vulnerable": true, "matchCriteriaId": "FF6E8D50-6B8B-43AA-9338-1A4DBE83DB34"}, {"criteria": "cpe:2.3:a:iobit:advanced_system_care:15:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "1DA08A7C-9D84-4C40-84B4-C0541BCAB266"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}