title: Secdo: Privilege escalation via hardcoded script path
description: Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.
problem types: CWE-73 External Control of File Name or Path
affected:
{
platforms: Windows
product: Secdo
vendor: Secdo
versions:
status: affected, version: all versions
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: This product is no longer supported and the issue is not going to be fixed. The issue can be completely mitigated by ensuring that unprivileged users do not have 'create folder' access on the root of the filesystem such as C:\ or on a folder named C:\Common.
workarounds: This issue can be mitigated by :
- Ensure unprivileged users do not have 'create folder' access on the root of filesystem such as C:\.
or
- Creating a folder named C:\Common and ensuring unprivileged users do not have 'create folder' access.