PT-2022-17250 · Unknown · Pritunl Client

David Yesland · Published 2022-02-20 · Updated 2022-04-27 · CVE-2022-25372

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pritunl Client versions 1.2.3019.52 and earlier

Description The issue allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform windows.go. This affects Pritunl Client on Windows.

Recommendations For Pritunl Client version 1.2.3019.52 and earlier, consider updating to a version that fixes the local privilege escalation issue, although the specific fixed version is not provided in the available data. As a temporary workaround, consider restricting access to the vulnerable ACL entry for CREATOR OWNER in platform windows.go until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-25372

Affected Products

Pritunl Client

References · 10

• 🔥 https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client · Exploit
• https://github.com/pritunl/pritunl-client-electron/commit/e16d47437f8ef62546aa00edb0d64be2a7d2205b · Patch
• https://osv.dev/vulnerability/CVE-2022-25372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25372 · Security Note
• https://github.com/pritunl/pritunl-client-electron/blob/caa78d626198b6961f3f39eca2acd39064c2df96/CHANGES#L6 · Note
• https://t.me/cvenotify/28820 · Telegram Post
• https://t.me/rnetsec/16684 · Telegram Post
• https://t.me/cvenotify/27106 · Telegram Post
• https://t.me/cvenotify/27506 · Telegram Post
• https://t.me/cibsecurity/37850 · Telegram Post