PT-2024-34346 · Microsoft+1 · Windows+1

Daniel Hirschberger + 2 · Published 2024-11-08 · Updated 2024-11-08 · CVE-2024-50591

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Elefant Software Updater (ESU) (affected versions not specified)

Description: An attacker with local access to a medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The vulnerability can be exploited by communicating with the Elefant Update Service, which is running as "SYSTEM" via Windows Named Pipes. The Elefant Software Updater (ESU) consists of two components: an ESU service that runs as "NT AUTHORITYSYSTEM" and an ESU tray client that communicates with the service to update or repair the installation and is running with user permissions. The communication is implemented using named pipes. A crafted message of type MessageType.SupportServiceInfos can be sent to the local ESU service to inject commands, which are then executed as "NT AUTHORITYSYSTEM".

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-50591

Affected Products

Elefant Software Updater

Windows

References · 8

• https://hasomed.de/produkte/elefant · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-50591 · Security Note
• https://t.me/cvenotify/101052 · Telegram Post
• https://twitter.com/CVEnew/status/1854863975625761279 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Nov/3 · Note
• https://t.me/cvedetector/10194 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1855021178294767626 · Twitter Post
• https://r.sec-consult.com/hasomed · Note