CVE-2024-4454 WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

What is CVE-2024-4454?

CVE-2024-4454 is a high-severity path traversal vulnerability in WithSecure Elements, published on 22 May 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability.

The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23035.

Weakness: CWE-59

Which versions are affected by CVE-2024-4454?

It affects 4 products.

Products include Withsecure Client Security, Withsecure Elements Endpoint Protection, Withsecure Email and Server Security, Withsecure Server Security.

How do I fix CVE-2024-4454?

No fix has been published for CVE-2024-4454 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-4454 being exploited?

There is no known exploitation of CVE-2024-4454 in the wild and no public exploit code.

Other vulnerabilities in WithSecure Elements

• CVE-2023-47172 Privilege escalation in n/a High 7.8
• CVE-2024-23764 Privilege escalation in n/a Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3qv8-vwg9-439r.