CVE-2022-48223

Vulnerability

The vulnerability resides in the Acuant AcuFill SDK prior to version 10.22.02.03. During the SDK repair process, the Acuant installer calls certutil.exe to repair certificates. This call is susceptible to DLL hijacking due to a race condition and insecure permissions on the executing directory, allowing an attacker to place a malicious DLL in the path [1].

Exploitation

An attacker must have local access or be able to write to the directory where the repair process executes. The race condition window allows the attacker to introduce a malicious DLL before certutil.exe loads it. The attacker does not require authentication beyond local user privileges to exploit the insecure permissions [1].

Impact

Successful exploitation results in arbitrary code execution with the privileges of the user running the repair (likely elevated). This could lead to full system compromise, including data exfiltration, installation of malware, or persistence [1].

Mitigation

Upgrade to Acuant AcuFill SDK version 10.22.02.03 or later, which contains the fix for this vulnerability. As of the publication date, no workarounds have been disclosed [1].