CVE-2022-34109

Vulnerability

An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size [1]. The vulnerability resides in the file handling functionality of the software.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted file or path to the Feature Navigator application, resulting in arbitrary file write to the \PromoPhoto\ directory [1]. The attack vector requires local access or the ability to interact with the software; no authentication is specified as necessary.

Impact

Successful exploitation allows an attacker to write any file to the \PromoPhoto\ directory, which could lead to code execution if the written file is subsequently executed or included by the application or another process [1]. The impact is limited to the ability to place files, but the full consequences depend on the system configuration.

Mitigation

No official fix has been released as of the publication date [1]. Users should consider removing or restricting access to MSI Feature Navigator, or monitoring the \PromoPhoto\ directory for unauthorized files. The vendor was contacted but did not respond, so no patch is currently available [1].