Insecure File Deletion in Malwarebytes AdwCleaner Affects Privilege Escalation

CVE-2023-28892

What is CVE-2023-28892?

Malwarebytes AdwCleaner version 8.4.0 contains a vulnerability that allows a non-administrative user to escalate their privileges to SYSTEM level. This is achieved through an insecure file deletion operation on the log file located at C:\AdwCleaner\Logs\AdwCleaner_Debug.log, where the target path is accessible to user control. The potential for abuse stems from the improper handling of symbolic links, which can be exploited in a malicious manner.

References