WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

Vulnerability

A local privilege escalation vulnerability exists in WithSecure Elements Endpoint Protection (CVE-2024-4454). The specific flaw resides in the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. Affected versions are not explicitly listed in the available references, but the advisory covers the product line up to the publication date of May 22, 2024 [1].

Exploitation

The attack is local and requires low privileges, but user interaction from an administrator is necessary to trigger the vulnerability. The attacker must first create a symbolic link, then convince an administrator to perform an action that causes the plugin hosting service to process the link. The exact sequence of steps is not detailed in the references, but the symbolic link manipulation leads to file creation by the service [1].

Impact

Successful exploitation allows the attacker to escalate privileges and execute arbitrary code in the context of SYSTEM, granting full control over the affected system. The impact compromises confidentiality, integrity, and availability [1].

Mitigation

As of the publication date, no patch or specific mitigation is disclosed in the available references. Users are advised to follow vendor advisories and apply updates when released. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time [1].