CVE-2023-26077

Vulnerability

Atera Agent through version 1.8.3.6 on Windows creates a temporary file in C:\Windows\Temp\AteraUpgradeAgentPackage with insecure permissions inherited from C:\Windows\Temp. An unprivileged user can trigger a repair operation via the Windows Installer API or by running msiexec.exe /fa on the cached MSI file in C:\Windows\Installer, which executes AgentPackageUpgradeAgent.exe as SYSTEM from that folder. [1]

Exploitation

An authenticated local attacker with write access to C:\Windows\Temp (inherited by the Atera upgrade folder) can place a malicious DLL in C:\Windows\Temp\AteraUpgradeAgentPackage. Triggering the repair operation causes the SYSTEM-level process to load the attacker's DLL, resulting in DLL hijacking. No user interaction beyond local authentication is required. [1]

Impact

Successful exploitation grants the attacker SYSTEM-level privileges, leading to full compromise of confidentiality, integrity, and availability. The CVSS base score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). [1]

Mitigation

The vulnerability is fixed in Atera Agent version 1.8.3.7, released on April 17, 2023. Users should update to this version or later. No workaround is available. [1]