CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://shibboleth.atlassian.net/browse/SSPCPP-961	Exploit Issue Tracking Third Party Advisory
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

cpe:2.3:a:shibboleth:service_provider:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-01-11 02:15

Updated : 2024-05-17 02:19

NVD link : CVE-2023-22947

Mitre link : CVE-2023-22947

CVE.ORG link : CVE-2023-22947

JSON object : View

Products Affected

shibboleth

service_provider

microsoft

windows

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2023-22947", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2023-01-11T02:15:11.550", "references": [{"url": "https://shibboleth.atlassian.net/browse/SSPCPP-961", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\\opt (rather than C:\\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that \"We consider the ACLs a best effort thing\" and \"it was a documentation mistake.\""}, {"lang": "es", "value": "Los permisos de carpeta inseguros en la ruta de instalaci\u00f3n de Windows de Shibboleth Service Provider (SP) anterior a 3.4.1 permiten a un atacante local sin privilegios escalar privilegios a SYSTEM mediante la instalaci\u00f3n de DLL en la carpeta del ejecutable del servicio. Esto ocurre porque la instalaci\u00f3n se realiza en C:\\opt (en lugar de C:\\Program Files) de forma predeterminada. NOTA: el proveedor cuestiona la importancia de este informe y afirma que \"Consideramos que las ACL son el mejor esfuerzo\" y \"fue un error de documentaci\u00f3n\"."}], "lastModified": "2024-05-17T02:19:47.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:shibboleth:service_provider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66776430-A405-4D69-9067-9996AC30AAB8", "versionEndExcluding": "3.4.1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}