Richard Warren

An insufficient validation exists on the server connection endpoint within Netskope Client. This flaw allows local users to elevate their privileges on the system. The inadequate validation permits Netskope Client to connect to any server utilizing publicly signed CA TLS certificates and transmit specifically crafted responses, ultimately leading to privilege escalation. The issue was discussed during a DEF CON #ZeroTrustTotalBust talk and a proof-of-concept (PoC) exploit has been released. The vulnerability allows a rogue server to manipulate responses and gain elevated access.

The issue is related to an insufficient certification validation in the GlobalProtect app, allowing attackers to connect the app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Over 1.4 million results are found to be potentially affected. The vulnerability can be exploited to achieve remote code execution and privilege escalation.

A validation issue existed in the handling of symlinks, which has been addressed with improved validation of symlinks. This could allow a local user to write arbitrary files.

The issue allows an attacker to write arbitrary files by unpacking a maliciously crafted archive. This is possible due to insufficient checks, which have been improved in the fixed version.

An authentication issue was addressed with improved state management, which could allow a local attacker to view the previous logged-in user’s desktop from the fast user switching screen.

A local user with low privileges could potentially exploit a DLL injection vulnerability in the Costura Fody plugin, leading to the execution of arbitrary executables on the operating system with SYSTEM privileges.