CVE-2023-29586

Vulnerability

TeraCopy version 3.9.7 fails to enforce proper access validation on the source folder during a copy operation. This allows any user to copy any directory on the system (including those with restricted access) to a destination they control, leading to arbitrary file read. The supplier disputes the finding, claiming only admin users can trigger the issue, but the official description states otherwise [2].

Exploitation

An attacker must have a local user account on the system. No special privileges are required. The attacker launches TeraCopy and selects a protected folder as the source and a publicly writable folder as the destination. The copy operation proceeds without checking whether the user has read access to the source directory [2].

Impact

Successful exploitation allows an unprivileged attacker to read any file on the system, including system files, configuration files, and other users' private data. This constitutes a violation of confidentiality, though integrity and availability are not directly affected. The attacker gains no additional privileges beyond the ability to read arbitrary files [2].

Mitigation

According to the vendor, the issue was resolved in TeraCopy version 3.5b [2]. Users running version 3.9.7 or any version prior to the fix should upgrade to the latest patched release. No workarounds are provided. This CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.