CVE-2019-19895

Vulnerability

In IXP EasyInstall version 6.2.13723, an authenticated attacker can perform lateral movement by modifying the file %SYSTEMDRIVE%\IXP\SW\[PACKAGE_CODE]\EveryLogon.bat. This file is executed at each logon for other users, allowing the attacker to inject arbitrary commands.

Exploitation

An attacker must have valid authentication to the target system. They then modify the EveryLogon.bat file corresponding to a specific package code. No additional privileges are required beyond standard user access to that file path. The modified script executes in the context of other users when they log on.

Impact

Successful exploitation allows the attacker to execute arbitrary code in the security context of other users on the same system. This leads to privilege escalation and lateral movement, potentially compromising sensitive data or system integrity.

Mitigation

As of the publication date (2020-01-23), no official patch or mitigation has been disclosed in the available references [1]. Organizations should consider restricting write access to the IXP\SW\ directory or monitoring modifications to batch files.