CVE-2023-22947 - Vulnerability Details - OpenCVE

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt (rather than C:\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that "We consider the ACLs a best effort thing" and "it was a documentation mistake."

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Windows
Shibboleth	Service Provider

Configuration 1 [-]

AND

cpe:2.3:a:shibboleth:service_provider:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://shibboleth.atlassian.net/browse/SSPCPP-961
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-01-11T00:00:00

Updated: 2024-08-02T10:20:31.400Z

Reserved: 2023-01-11T00:00:00

Link: CVE-2023-22947

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-11T02:15:11.550

Modified: 2024-11-21T07:45:41.930

Link: CVE-2023-22947

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shibboleth:service_provider:*:*:*:*:*:*:*:*", "matchCriteriaId": "66776430-A405-4D69-9067-9996AC30AAB8", "versionEndExcluding": "3.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\\opt (rather than C:\\Program Files) by default. NOTE: the vendor disputes the significance of this report, stating that \"We consider the ACLs a best effort thing\" and \"it was a documentation mistake.\""}, {"lang": "es", "value": "Los permisos de carpeta inseguros en la ruta de instalaci\u00f3n de Windows de Shibboleth Service Provider (SP) anterior a 3.4.1 permiten a un atacante local sin privilegios escalar privilegios a SYSTEM mediante la instalaci\u00f3n de DLL en la carpeta del ejecutable del servicio. Esto ocurre porque la instalaci\u00f3n se realiza en C:\\opt (en lugar de C:\\Program Files) de forma predeterminada. NOTA: el proveedor cuestiona la importancia de este informe y afirma que \"Consideramos que las ACL son el mejor esfuerzo\" y \"fue un error de documentaci\u00f3n\"."}], "id": "CVE-2023-22947", "lastModified": "2024-11-21T07:45:41.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-11T02:15:11.550", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://shibboleth.atlassian.net/browse/SSPCPP-961"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://shibboleth.atlassian.net/browse/SSPCPP-961"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335545/Install+on+Windows#Restricting-ACLs"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}