High
CVE-2020-1984
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2020-1984
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with ‘create folders or append data’ access to the root of the OS disk (C:) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityHigh
Technical Analysis
CVE-2020-1984 Secdo: Privilege escalation via hardcoded script path
Attack Vector LOCAL
Attack Complexity LOW
Privileges Required LOW
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact HIGH
Description
Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with ‘create folders or append data’ access to the root of the OS disk (C:) to gain system privileges if the path does not already exist or is writable.
Product Status
Secdo
Versions Affected
all versions on Windows
Severity: HIGH
CVSSv3.1 Base Score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Solution
This product is no longer supported and the issue is not going to be fixed. The issue can be completely mitigated by ensuring that unprivileged users do not have ‘create folder’ access on the root of the filesystem such as C:\ or on a folder named C:\Common.
##Workarounds and Mitigations
This issue can be mitigated by :
- Ensure unprivileged users do not have ‘create folder’ access on the root of filesystem such as C:.
or
- Creating a folder named C:\Common and ensuring unprivileged users do not have ‘create folder’ access.
Acknowledgements
We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- paloaltonetworks
Products
- secdo
References
Miscellaneous
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
