Privilege Escalation in SailPoint Desktop Password Reset by SailPoint
CVE-2019-12889

7HIGH

Key Information:

Vendor

Sailpoint

Status
Desktop Password Reset
Vendor
CVE Published:
20 August 2019

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-12889?

An unprivileged user with local access to the Windows logon screen can exploit a vulnerability in SailPoint Desktop Password Reset version 7.2 to escalate their privileges to NT AUTHORITY\System. To perform the attack, the user must first disconnect the computer from the local network and connect it to an externally accessible network. Subsequently, by triggering the password-reset functionality, they can access a web browser. If they navigate to a site capable of invoking local Windows system functions, such as uploading files, it can reveal the local file system, allowing them to launch a command shell with elevated privileges.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-12889
Created by nulsect0r

References

https://github.com/nulsect0r/CVE-2019-12889
x_refsource_MISC

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.
CVE-2019-12889 : Privilege Escalation in SailPoint Desktop Password Reset by SailPoint