title: 1E Client installer can perform arbitrary file deletion on protected files
description: 1E Client installer can perform arbitrary file deletion on protected files.
A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup.
A hotfix is available from the 1E support portal that forces the 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.
for v8.1 use hotfix Q23097
for v8.4 use hotfix Q23105
for v9.0 use hotfix Q23115
for SaaS customers, use 1EClient v23.7 plus hotfix Q23121
problem types: CWE-59 Improper Link Resolution Before File Access ('Link Following')
affected:
{
defaultStatus: affected
platforms: Windows
product: 1E Client
vendor: 1E
versions:
changes: [at: Q23097, status: unaffected], lessThan: 8.1.2.62, status: affected, version: 0, versionType: Q23097
changes: [at: Q23105, status: unaffected], lessThan: 8.4.1.159, status: affected, version: 0, versionType: Q23105
changes: [at: Q23115, status: unaffected], lessThan: 9.0.1.88, status: affected, version: 0, versionType: Q23115
changes: [at: Q23121, status: unaffected], lessThan: 23.7.1.151, status: affected, version: 0, versionType: Q23121
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL