CVE-2024-50590 Local Privilege Escalation via Weak Service Binary Permissions
Local attackers can escalate privileges to SYSTEM by overwriting weakly permissioned service binaries in the default installation directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50590?
CVE-2024-50590 is a high-severity vulnerability in HASOMED Elefant, published on 8 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. In addition, the Elefant installer registers two Firebird database services which are running as “NT AUTHORITY\SYSTEM”.
Path: C:\Elefant1\Firebird_2\bin\fbserver.exe
Path: C:\Elefant1\Firebird_2\bin\fbguard.exe
Both service binaries are user writable. This means that a local attacker can rename one of the service binaries, replace the service executable with a new executable, and then restart the system. Once the system has rebooted, the new service binary is executed as "NT AUTHORITY\SYSTEM".
Which versions are affected by CVE-2024-50590?
How do I fix CVE-2024-50590?
No fix has been published for CVE-2024-50590 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-50590 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50590 exists.
Sources
Also known as GHSA-g632-g6jh-g6fg.