CVE-2019-17201

Vulnerability

FastTrack Admin By Request 6.1.0.0 supports group policies intended to restrict which users can elevate to Administrator privilege. The elevation mechanism uses a .NET named pipe for communication between the AdminByRequest.exe interface and the underlying service (Audckq32.exe). The service relies on client-side validation in the interface to enforce access control, which means the service itself does not perform any local checks when an elevation request is received [1]. This design flaw exposes a vulnerable functionality that can be accessed by any process on the local machine.

Exploitation

An attacker with local access to a system running FastTrack Admin By Request 6.1.0.0 does not need any special privileges or group policy membership. By crafting a direct communication to the .NET named pipe used by the Audckq32.exe service, the attacker can bypass the AdminByRequest.exe interface entirely. The service will accept the elevation request without verifying the requesting user's credentials or group policy permissions [1][2]. No user interaction is required beyond the initial local access.

Impact

Successful exploitation allows an unprivileged attacker to obtain full Administrator privileges on the affected machine. This completely bypasses the group policies that were intended to restrict elevation, giving the attacker complete control over the system, including the ability to install software, modify system files, create new accounts, and perform any other administrative actions [2].

Mitigation

The vendor has not released a patch for version 6.1.0.0. The release notes from Admin By Request show that subsequent major versions (7.x and 8.x) are available, but the vulnerability was disclosed in version 6.1.0.0 and the fixed version is not clearly identified in the references [1]. Users should upgrade to a currently supported version of Admin By Request (7.4 or later) to ensure this bypass is addressed. No workaround is provided in the available references.