Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Krischat Thataristorai

Researcher fromSecure D Research Team
#44449of 60,378
7.1Total CVSS
Vulnerabilities · 1
PT-2021-21204
2021-09-28
7.1
CVE-2021-36286
Microsoft
Windows
The issue concerns an arbitrary file deletion vulnerability that can be exploited using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any non-privileged user under some object directories. However, combining them with a different object, such as the NTFS junction point, allows for the exploitation. The SupportAssist clean files functionality does not distinguish junction points from the physical folder and proceeds to clean the target of the junction, allowing non-privileged users to create junction points and delete arbitrary files on the system that can be accessed only by the admin.