Local privilege escalation using log file

CVE-2022-4149

What is CVE-2022-4149?

The Netskope Client Service prior to version R96 on Windows operates with NT AUTHORITY\SYSTEM privileges and logs data to a publicly writable directory (C:\Users\Public\netSkope). This directory setup leads to a race condition where a malicious local user can exploit the logplaceholder file, which allows broad access rights. By creating this file with modified ACL permissions, attackers can manipulate other files within the directory. The use of Windows pseudo-symlinks permits these malicious users to elevate their privileges and potentially gain unauthorized access to sensitive system areas.

References