title: Local privilege escalation using log file
description: The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
problem types: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
affected:
{
defaultStatus: unaffected
platforms: Windows
product: Netskope Client
vendor: Netskope
versions:
status: affected, version: 95, 0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Netskope is not aware of any public disclosure and exploitation of this vulnerability at the time of publication.
solutions: Netskope has patched the vulnerability and released a binary with a fix. Customers are recommended to upgrade their Netskope clients to v100 or later. Netskope download Instructions –  Download Netskope Client and Scripts – Netskope Support https://support.netskope.com/s/article/Download-Netskope-Client-and-Scripts
workarounds: Netskope recommends using hardening guidelines listed here - –  https://docs.netskope.com/en/netskope-client-hardening.html https://docs.netskope.com/en/netskope-client-hardening.html