Richard Warren

يوجد نقص في التحقق من صحة البيانات في نقطة نهاية اتصال الخادم في برنامج Netskope Client لنظام التشغيل Windows. تسمح هذه الثغرة للمستخدمين المحليين برفع امتيازاتهم في النظام. يسمح هذا التحقق غير الكافي لـ Netskope Client بإقامة اتصالات مع أي خادم يمتلك شهادات TLS CA موقعة علنًا وإرسال استجابات مصممة خصيصًا، مما يؤدي إلى رفع مستوى الامتيازات. تمت مناقشة المشكلة خلال محاضرة في DEF CON #ZeroTrustTotalBust وتم نشر استغلال لإثبات المفهوم (PoC).

The issue is related to an insufficient certification validation in the GlobalProtect app, allowing attackers to connect the app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Over 1.4 million results are found to be potentially affected. The vulnerability can be exploited to achieve remote code execution and privilege escalation.

A validation issue existed in the handling of symlinks, which has been addressed with improved validation of symlinks. This could allow a local user to write arbitrary files.

The issue allows an attacker to write arbitrary files by unpacking a maliciously crafted archive. This is possible due to insufficient checks, which have been improved in the fixed version.

An authentication issue was addressed with improved state management, which could allow a local attacker to view the previous logged-in user’s desktop from the fast user switching screen.

A local user with low privileges could potentially exploit a DLL injection vulnerability in the Costura Fody plugin, leading to the execution of arbitrary executables on the operating system with SYSTEM privileges.