PT-2022-16489 · Iobit · Iobit Advanced Systemcare

Tomerpeled92 · Published 2022-07-06 · Updated 2022-07-15 · CVE-2022-24139

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IOBit Advanced System Care version 15

Description The issue allows an attacker with SEImpersonatePrivilege to create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes. During login, the service will try to connect to the attacker, leading to either escalation of privileges from ADMIN to SYSTEM or from Local ADMIN to Domain ADMIN, depending on the user and named pipe used. This is achieved through token manipulation and the use of the ImpersonateNamedPipeClient() function.

Recommendations For IOBit Advanced System Care version 15, consider disabling the named pipe functionality until a patch is available to prevent potential privilege escalation. Restrict access to the named pipes used by ASCService to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2022-24139

Affected Products

Iobit Advanced Systemcare

References · 6

• 🔥 https://github.com/tomerpeled92/CVE · Exploit
• http://iobit.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24139 · Security Note
• https://t.me/cibsecurity/45642 · Telegram Post
• http://advanced.com · Note