Vulnerability Description
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netskope | Netskope | < 100 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://www.netskope.com/company/security-compliance-and-assurance/security-adviVendor Advisory
- https://www.netskope.com/company/security-compliance-and-assurance/security-adviVendor Advisory
FAQ
What is CVE-2022-4149?
CVE-2022-4149 is a vulnerability with a CVSS score of 7.0 (HIGH). The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created a...
How severe is CVE-2022-4149?
CVE-2022-4149 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-4149?
Check the references section above for vendor advisories and patch information. Affected products include: Netskope Netskope, Microsoft Windows.