Local Privilege Escalation Vulnerability in Forescout CounterACT Logging Function

CVE-2021-28098

What is CVE-2021-28098?

A local privilege escalation vulnerability exists in Forescout CounterACT due to improper permissions on the log file created by SecureConnector. The application's logging function writes logs to a directory with full permissions accessible to all users, which enables an attacker to exploit the vulnerability using symbolic links. By redirecting the log file to a sensitive location like %WINDIR%\System32, the attacker can manipulate file permissions and potentially replace legitimate files with malicious DLLs, facilitating DLL hijacking attacks.

References