GHSA-vx2x-9cff-fhjw DSInternals Credential Roaming Elevation of Privilege Vulnerability
A path traversal vulnerability in DSInternals allows attackers with AD write access to modify files on systems running privileged applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vx2x-9cff-fhjw?
GHSA-vx2x-9cff-fhjw is a path traversal vulnerability in DSInternals.Common, published on 6 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
A vulnerability exists in the DSInternals.Common.Data.RoamedCredential.Save() method, which incorrectly parses the msPKIAccountCredentials LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges.
A similar security issue used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows.
Exploitability
The vulnerability can be exploited under the following circumstances:
- An attacker is able to modify the
msPKIAccountCredentialsattribute of a user account in Active Directory. This attribute is used by the Credential Roaming feature of Windows and each AD user can modify their own roamed credentials. AND - A 3rd party application uses the
DSInternals.Commonlibrary to export roamed credentials from Active Directory to a file system. AND - The application has administrative privileges on the local system.
The probability of any 3rd-party product using the DSInternals.Common library being affected by this vulnerability is extremely low.
Patches
The issue had been fixed in DSInternals 4.8.
References
https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
Which versions are affected by GHSA-vx2x-9cff-fhjw?
2 open source packages ship an affected version, including DSInternals.Common.
| Package | Affected | Fixed in |
|---|---|---|
DSInternals.Common NuGet | From 2.21 | 4.8 |
DSInternals.Common NuGet | From 2.21 | 4.8 |
How do I fix GHSA-vx2x-9cff-fhjw?
Upgrade DSInternals.Common to 4.8 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-vx2x-9cff-fhjw being exploited?
There is no known exploitation of GHSA-vx2x-9cff-fhjw in the wild and no public exploit code.