PT-2023-29471 · Huddly · Huddlycameraservice

Henrik Pedersen · Publicado 2023-12-01 · Atualizado 2023-12-19 · CVE-2023-45253

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huddly HuddlyCameraService versions prior to 8.0.7, excluding version 7.99

Description An issue in HuddlyCameraService allows attackers to manipulate files and escalate privileges via the RollingFileAppender.DeleteFile method performed by the log4net library. Additionally, a DLL Hijacking vulnerability exists due to the service installation in a directory that grants write privileges to standard users, allowing attackers to manipulate files, execute arbitrary code, and escalate privileges.

Recommendations For versions prior to 8.0.7, excluding version 7.99, update to version 8.0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the directory where the service is installed to prevent standard users from gaining write privileges. Avoid using the RollingFileAppender.DeleteFile method until the issue is resolved.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2023-45253

Produtos afetados

Huddlycameraservice

Referências · 10

• 🔥 https://xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253 · Exploit
• https://t.me/cvenotify/62991 · Publicação no Telegram
• https://t.me/cvenotify/61862 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45253 · Nota de Segurança
• https://t.me/cvenotify/62992 · Publicação no Telegram
• https://t.me/cvenotify/61846 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45253 · Aviso do Fabricante
• https://twitter.com/NUYTSTECH/status/1737342953281269904 · Publicação no Twitter
• https://t.me/cvenotify/61861 · Publicação no Telegram
• https://t.me/cvenotify/61845 · Publicação no Telegram