PT-2022-12371 · Sage · Sage 300 Erp

Konrad Haase

·

Published

2022-07-14

·

Updated

2023-08-08

·

CVE-2021-45492

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Sage 300 ERP versions through 6.8.x
Description The installer configures the C:SageSage300Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions and therefore inherits weak permissions from the C: folder. Because entries in the system-wide PATH variable are included in the search order for DLLs, an attacker could perform DLL search-order hijacking to escalate their privileges to SYSTEM. Furthermore, if the Global Search or Web Screens functionality is enabled, then privilege escalation is possible via the GlobalSearchService and Sage.CNA.WindowsService services, again via DLL search-order hijacking because unprivileged users would have modify permissions on the application directory.
Recommendations For Sage 300 ERP versions through 6.8.x, consider disabling the Global Search or Web Screens functionality to minimize the risk of exploitation. Restrict access to the C:SageSage300Runtime directory to prevent unprivileged users from modifying its contents. As a temporary workaround, consider setting explicit permissions on the C:SageSage300Runtime directory to prevent weak permissions from being inherited from the C: folder. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-45492

Affected Products

Sage 300 Erp